summaryrefslogtreecommitdiff
path: root/drivers/crypto
diff options
context:
space:
mode:
authorRob Rice <rob.rice@broadcom.com>2017-02-14 20:45:52 +0300
committerHerbert Xu <herbert@gondor.apana.org.au>2017-02-15 08:23:51 +0300
commitdcd36c436c9c1c5052be6bc2a9200e4e6dfbd267 (patch)
tree861d2a7706f6111930623c69fa47ce87f70dbac1 /drivers/crypto
parenteafa26696a648f974942e12f42460abff80a646d (diff)
downloadlinux-dcd36c436c9c1c5052be6bc2a9200e4e6dfbd267.tar.xz
crypto: brcm - Avoid double free in ahash_finup()
In Broadcom SPU driver, in case where incremental hash is done in software in ahash_finup(), tmpbuf was freed twice. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Rob Rice <rob.rice@broadcom.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'drivers/crypto')
-rw-r--r--drivers/crypto/bcm/cipher.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
index a654a01ff2ba..cc0d5b98006e 100644
--- a/drivers/crypto/bcm/cipher.c
+++ b/drivers/crypto/bcm/cipher.c
@@ -2331,7 +2331,6 @@ static int ahash_finup(struct ahash_request *req)
/* Call synchronous update */
ret = crypto_shash_finup(ctx->shash, tmpbuf, req->nbytes,
req->result);
- kfree(tmpbuf);
} else {
/* Otherwise call the internal function which uses SPU hw */
return __ahash_finup(req);