Patch "crypto: af_alg - fix race accessing cipher request" has been added to the 4.14-stable tree

PATCH [email protected] 1 participant 1 message Dec 27, 2017

Subsystems (2)

Stable branch Crypto API

lore

Share & tools

lore

[email protected]

author maintainer Applied

2017-12-27 15:28 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

crypto: af_alg - fix race accessing cipher request

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
crypto-af_alg-fix-race-accessing-cipher-request.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From d53c5135792319e095bb126bc43b2ee98586f7fe Mon Sep 17 00:00:00 2001

From: Stephan Mueller <[email protected]>
Date: Fri, 8 Dec 2017 11:50:37 +0100
Subject: crypto: af_alg - fix race accessing cipher request

From: Stephan Mueller <[email protected]>

commit d53c5135792319e095bb126bc43b2ee98586f7fe upstream.

When invoking an asynchronous cipher operation, the invocation of the callback may be performed before the subsequent operations in the initial code path are invoked. The callback deletes the cipher request data structure which implies that after the invocation of the asynchronous cipher operation, this data structure must not be accessed any more.

The setting of the return code size with the request data structure must therefore be moved before the invocation of the asynchronous cipher operation.

Fixes e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")

Fixes d887c52d6ae4 ("crypto: algif_aead - overhaul memory management")

Reported-by syzbot <[email protected]>

Signed-off-by Stephan Mueller <[email protected]>

Acked-by Jonathan Cameron <[email protected]>

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 crypto/algif_aead.c     |   10 +++++-----
 crypto/algif_skcipher.c |   10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

crypto/algif_aead.c +5 -5

@@ -291,6 +291,10 @@ static int _aead_recvmsg(struct socket *
 		/* AIO operation */
 		sock_hold(sk);
 		areq->iocb = msg->msg_iocb;
+
+		/* Remember output size that will be generated. */
+		areq->outlen = outlen;
+
 		aead_request_set_callback(&areq->cra_u.aead_req,
 					  CRYPTO_TFM_REQ_MAY_BACKLOG,
 					  af_alg_async_cb, areq);

@@ -298,12 +302,8 @@ static int _aead_recvmsg(struct socket *
 				 crypto_aead_decrypt(&areq->cra_u.aead_req);
 
 		/* AIO operation in progress */
-		if (err == -EINPROGRESS || err == -EBUSY) {
-			/* Remember output size that will be generated. */
-			areq->outlen = outlen;
-
+		if (err == -EINPROGRESS || err == -EBUSY)
 			return -EIOCBQUEUED;
-		}
 
 		sock_put(sk);
 	} else {

crypto/algif_skcipher.c +5 -5

@@ -125,6 +125,10 @@ static int _skcipher_recvmsg(struct sock
 		/* AIO operation */
 		sock_hold(sk);
 		areq->iocb = msg->msg_iocb;
+
+		/* Remember output size that will be generated. */
+		areq->outlen = len;
+
 		skcipher_request_set_callback(&areq->cra_u.skcipher_req,
 					      CRYPTO_TFM_REQ_MAY_SLEEP,
 					      af_alg_async_cb, areq);

@@ -133,12 +137,8 @@ static int _skcipher_recvmsg(struct sock
 			crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);
 
 		/* AIO operation in progress */
-		if (err == -EINPROGRESS || err == -EBUSY) {
-			/* Remember output size that will be generated. */
-			areq->outlen = len;
-
+		if (err == -EINPROGRESS || err == -EBUSY)
 			return -EIOCBQUEUED;
-		}
 
 		sock_put(sk);
 	} else {

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/crypto-af_alg-wait-for-data-at-beginning-of-recvmsg.patch queue-4.14/crypto-af_alg-fix-race-accessing-cipher-request.patch