Patch "crypto: algif_aead - Fix bogus request dereference in completion function" has been added to the 4.10-stable tree

This is a note to let you know that I've just added the patch titled

crypto: algif_aead - Fix bogus request dereference in completion function

to the 4.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
crypto-algif_aead-fix-bogus-request-dereference-in-completion-function.patch
and it can be found in the queue-4.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Herbert Xu <[email protected]>
Date: Mon, 10 Apr 2017 17:59:07 +0800
Subject: crypto: algif_aead - Fix bogus request dereference in completion function

From: Herbert Xu <[email protected]>

commit e6534aebb26e32fbab14df9c713c65e8507d17e4 upstream.

The algif_aead completion function tries to deduce the aead_request from the crypto_async_request argument. This is broken because the API does not guarantee that the same request will be pased to the completion function. Only the value of req->data can be used in the completion function.

This patch fixes it by storing a pointer to sk in areq and using that instead of passing in sk through req->data.

---
 crypto/algif_aead.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

@@ -39,6 +39,7 @@ struct aead_async_req {
 	struct aead_async_rsgl first_rsgl;
 	struct list_head list;
 	struct kiocb *iocb;
+	struct sock *sk;
 	unsigned int tsgls;
 	char iv[];
 };

@@ -378,12 +379,10 @@ unlock:
 
 static void aead_async_cb(struct crypto_async_request *_req, int err)
 {
-	struct sock *sk = _req->data;
-	struct alg_sock *ask = alg_sk(sk);
-	struct aead_ctx *ctx = ask->private;
-	struct crypto_aead *tfm = crypto_aead_reqtfm(&ctx->aead_req);
-	struct aead_request *req = aead_request_cast(_req);
+	struct aead_request *req = _req->data;
+	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
 	struct aead_async_req *areq = GET_ASYM_REQ(req, tfm);
+	struct sock *sk = areq->sk;
 	struct scatterlist *sg = areq->tsgl;
 	struct aead_async_rsgl *rsgl;
 	struct kiocb *iocb = areq->iocb;

@@ -446,11 +445,12 @@ static int aead_recvmsg_async(struct soc
 	memset(&areq->first_rsgl, '\0', sizeof(areq->first_rsgl));
 	INIT_LIST_HEAD(&areq->list);
 	areq->iocb = msg->msg_iocb;
+	areq->sk = sk;
 	memcpy(areq->iv, ctx->iv, crypto_aead_ivsize(tfm));
 	aead_request_set_tfm(req, tfm);
 	aead_request_set_ad(req, ctx->aead_assoclen);
 	aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
-				  aead_async_cb, sk);
+				  aead_async_cb, req);
 	used -= ctx->aead_assoclen;
 
 	/* take over all tx sgls from ctx */

Patches currently in stable-queue which might be from [email protected] are

queue-4.10/crypto-lrw-fix-use-after-free-on-einprogress.patch queue-4.10/crypto-algif_aead-fix-bogus-request-dereference-in-completion-function.patch queue-4.10/crypto-ahash-fix-einprogress-notification-callback.patch queue-4.10/crypto-xts-fix-use-after-free-on-einprogress.patch