crypto: algif_hash - fix double free in hash_accept
If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Fixes: fe869cdb ("crypto: algif_hash - User-space interface for hash operations") Cc: <stable@vger.kernel.org> Signed-off-by:Ivan Pravdin <ipravdin.official@gmail.com> Signed-off-by:
Herbert Xu <herbert@gondor.apana.org.au>
Loading
Please register or sign in to comment