This is a note to let you know that I've just added the patch titled crypto: drbg - always try to free Jitter RNG instance to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: crypto-drbg-always-try-to-free-jitter-rng-instance.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Fri Jun 17 08:58:56 AM CEST 2022 From: "Stephan Müller" <smueller@xxxxxxxxxx> Date: Sun, 7 Jun 2020 15:20:26 +0200 Subject: crypto: drbg - always try to free Jitter RNG instance From: "Stephan Müller" <smueller@xxxxxxxxxx> commit 819966c06b759022e9932f328284314d9272b9f3 upstream. The Jitter RNG is unconditionally allocated as a seed source follwoing the patch 97f2650e5040. Thus, the instance must always be deallocated. Reported-by: syzbot+2e635807decef724a1fa@xxxxxxxxxxxxxxxxxxxxxxxxx Fixes: 97f2650e5040 ("crypto: drbg - always seeded with SP800-90B ...") Signed-off-by: Stephan Mueller <smueller@xxxxxxxxxx> Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Jason A. Donenfeld <Jason@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- crypto/drbg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/crypto/drbg.c +++ b/crypto/drbg.c @@ -1644,10 +1644,12 @@ static int drbg_uninstantiate(struct drb if (drbg->random_ready.notifier_call) { unregister_random_ready_notifier(&drbg->random_ready); cancel_work_sync(&drbg->seed_work); - crypto_free_rng(drbg->jent); - drbg->jent = NULL; } + if (!IS_ERR_OR_NULL(drbg->jent)) + crypto_free_rng(drbg->jent); + drbg->jent = NULL; + if (drbg->d_ops) drbg->d_ops->crypto_fini(drbg); drbg_dealloc_state(drbg); Patches currently in stable-queue which might be from smueller@xxxxxxxxxx are queue-4.19/crypto-drbg-add-fips-140-2-ctrng-for-noise-source.patch queue-4.19/crypto-drbg-prepare-for-more-fine-grained-tracking-of-seeding-state.patch queue-4.19/crypto-drbg-always-try-to-free-jitter-rng-instance.patch queue-4.19/crypto-drbg-track-whether-drbg-was-seeded-with-rng_is_initialized.patch queue-4.19/crypto-drbg-move-dynamic-reseed_threshold-adjustments-to-__drbg_seed.patch queue-4.19/crypto-drbg-always-seeded-with-sp800-90b-compliant-noise-source.patch