Re: crypto: use-after-free in hash_sock_destruct_common

From	Herbert Xu <herbert@gondor.apana.org.au>
Newsgroups	linux.kernel
Subject	Re: crypto: use-after-free in hash_sock_destruct_common
Date	2016-01-13 08:00 +0100
Message-ID	<qQnzs-4iP-3@gated-at.bofh.it> (permalink)
References	<qQc1k-4Ra-27@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, Jan 12, 2016 at 07:31:03PM +0100, Dmitry Vyukov wrote:
> 
> The following program triggers use-after-free in
> hash_sock_destruct_common. This is on master of
> git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git
> (cd7e98414462b9db70067ac29896c58210b13b69). I've also seen a similar
> crash in skcipher_sock_destruct_common.

OK the new compatibility nokey path introduced some new problems.
Please try the following patches.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Thread

crypto: use-after-free in hash_sock_destruct_common Dmitry Vyukov <dvyukov@google.com> - 2016-01-12 19:40 +0100
  crypto: af_alg - Allow af_af_alg_release_parent to be called on  nokey path Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:00 +0100
    [PATCH 4/4] crypto: af_alg - Forbid bind(2) when nokey child sockets  are present Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:10 +0100
    [PATCH 3/4] crypto: algif_skcipher - Remove custom release parent  function Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:10 +0100
    [PATCH 2/4] crypto: algif_hash - Remove custom release parent  function Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:10 +0100
  Re: crypto: use-after-free in hash_sock_destruct_common Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:00 +0100
    Re: crypto: use-after-free in hash_sock_destruct_common Dmitry Vyukov <dvyukov@google.com> - 2016-01-13 11:30 +0100

csiph-web