diff options
| author | Richard Yao <[email protected]> | 2022-09-15 14:46:42 -0400 |
|---|---|---|
| committer | GitHub <[email protected]> | 2022-09-15 11:46:42 -0700 |
| commit | fd8c3012b3eedc6eed3dda67bf71cfb243400128 (patch) | |
| tree | 0485bb8100f486983e44bd2ea8719fc95cdce30b /module | |
| parent | 6f8602a5ede2c156f41630ba687701262f1350d6 (diff) | |
Fix use-after-free bugs in icp code
These were reported by Coverity as "Read from pointer after free" bugs.
Presumably, it did not report it as a use-after-free bug because it does
not understand the inline assembly that implements the atomic
instruction.
Reviewed-by: Brian Behlendorf <[email protected]>
Signed-off-by: Richard Yao <[email protected]>
Closes #13881
Diffstat (limited to 'module')
| -rw-r--r-- | module/icp/core/kcf_mech_tabs.c | 2 | ||||
| -rw-r--r-- | module/icp/core/kcf_prov_tabs.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/module/icp/core/kcf_mech_tabs.c b/module/icp/core/kcf_mech_tabs.c index 3d5063b28..41705e84b 100644 --- a/module/icp/core/kcf_mech_tabs.c +++ b/module/icp/core/kcf_mech_tabs.c @@ -342,8 +342,8 @@ kcf_remove_mech_provider(const char *mech_name, kcf_provider_desc_t *prov_desc) mech_entry->me_sw_prov = NULL; /* free entry */ - KCF_PROV_REFRELE(prov_mech->pm_prov_desc); KCF_PROV_IREFRELE(prov_mech->pm_prov_desc); + KCF_PROV_REFRELE(prov_mech->pm_prov_desc); kmem_free(prov_mech, sizeof (kcf_prov_mech_desc_t)); } diff --git a/module/icp/core/kcf_prov_tabs.c b/module/icp/core/kcf_prov_tabs.c index 865d4e19c..93af61a23 100644 --- a/module/icp/core/kcf_prov_tabs.c +++ b/module/icp/core/kcf_prov_tabs.c @@ -158,8 +158,8 @@ kcf_prov_tab_rem_provider(crypto_provider_id_t prov_id) * at that time. */ - KCF_PROV_REFRELE(prov_desc); KCF_PROV_IREFRELE(prov_desc); + KCF_PROV_REFRELE(prov_desc); return (CRYPTO_SUCCESS); } |