Re: [PATCH v2] crypto: essiv: fix use-after-free in AEAD path

[Herbert Xu]

On Thu, Oct 15, 2026 at 12:17:43PM +0000, Jérémy Jean wrote:
>
> @@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
>  				  essiv_aead_done, req);
>  	aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv);
>  
> +	assoc = rctx->assoc;
>  	err = enc ? crypto_aead_encrypt(subreq) :
>  		    crypto_aead_decrypt(subreq);
>  
> -	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
> -		kfree(rctx->assoc);
> +	if (err != -EINPROGRESS && err != -EBUSY)
> +		kfree(assoc);

There is no need for assoc at all once the rctx->assoc test is
dropped.  If the condition is true then rctx cannot have been
freed.

Cheers,
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt