Re: [PATCH] crypto: essiv: fix use-after-free in AEAD path

[Jérémy Jean]

On 2026-10-15 05:38, Herbert Xu wrote:
> On Wed, Oct 14, 2026 at 10:23:51PM +0000, Jérémy Jean wrote:
> > @@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request 
> > *req, bool enc)
> >  				  essiv_aead_done, req);
> >  	aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, 
> > req->iv);
> >
> > +	assoc = rctx->assoc;
> >  	err = enc ? crypto_aead_encrypt(subreq) :
> >  		    crypto_aead_decrypt(subreq);
> >
> > -	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
> > -		kfree(rctx->assoc);
> > +	if (assoc && err != -EINPROGRESS && err != -EBUSY)
> > +		kfree(assoc);
>
> Last time this came up Ard asked for the rctx->assoc != NULL test
> to be dropped completely.  Could you please do that and resend?

Hello,

Thanks for the feedback.
I have updated the patch, and will send a v2 shortly.

Regards,
Jérémy