[PATCH] crypto: ixp4xx - Free the fallback cipher if context initialization fails

[Wentao Liang]

init_tfm_ablk() allocates a fallback skcipher before calling init_tfm().
If allocating either security association context fails, init_tfm()
returns an error and the fallback is left allocated. The crypto core
does not call the algorithm exit callback after a failed initialization,
so exit_tfm_ablk() cannot release it.

Free the fallback cipher when init_tfm() fails. The security association
contexts are already unwound by init_tfm().

Fixes: dfb098d692ea ("crypto: ixp4xx - fallback when having more than one SG")
Cc: stable at vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab at iscas.ac.cn>
---
 drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c b/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c
index 33e8e887a415..6af50a01c96f 100644
--- a/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c
+++ b/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c
@@ -635,6 +635,7 @@ static int init_tfm_ablk(struct crypto_skcipher *tfm)
 	struct crypto_tfm *ctfm = crypto_skcipher_tfm(tfm);
 	struct ixp_ctx *ctx = crypto_tfm_ctx(ctfm);
 	const char *name = crypto_tfm_alg_name(ctfm);
+	int ret;
 
 	ctx->fallback_tfm = crypto_alloc_skcipher(name, 0, CRYPTO_ALG_NEED_FALLBACK);
 	if (IS_ERR(ctx->fallback_tfm)) {
@@ -649,7 +650,11 @@ static int init_tfm_ablk(struct crypto_skcipher *tfm)
 		 );
 
 	crypto_skcipher_set_reqsize(tfm, sizeof(struct ablk_ctx) + crypto_skcipher_reqsize(ctx->fallback_tfm));
-	return init_tfm(crypto_skcipher_tfm(tfm));
+	ret = init_tfm(crypto_skcipher_tfm(tfm));
+	if (ret)
+		crypto_free_skcipher(ctx->fallback_tfm);
+
+	return ret;
 }
 
 static int init_tfm_aead(struct crypto_aead *tfm)
-- 
2.34.1