Re: crypto: use-after-free in hash_sock_destruct_common

From	Dmitry Vyukov <dvyukov@google.com>
Newsgroups	linux.kernel
Subject	Re: crypto: use-after-free in hash_sock_destruct_common
Date	2016-01-13 11:30 +0100
Message-ID	<qQqQG-6Le-27@gated-at.bofh.it> (permalink)
References	<qQc1k-4Ra-27@gated-at.bofh.it> <qQnzs-4iP-3@gated-at.bofh.it> <qQqQG-6Le-29@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Jan 13, 2016 at 11:25 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
> On Wed, Jan 13, 2016 at 7:57 AM, Herbert Xu <herbert@gondor.apana.org.au>
> wrote:
>>
>> On Tue, Jan 12, 2016 at 07:31:03PM +0100, Dmitry Vyukov wrote:
>> >
>> > The following program triggers use-after-free in
>> > hash_sock_destruct_common. This is on master of
>> > git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git
>> > (cd7e98414462b9db70067ac29896c58210b13b69). I've also seen a similar
>> > crash in skcipher_sock_destruct_common.
>>
>> OK the new compatibility nokey path introduced some new problems.
>> Please try the following patches.
>
>
> Yes, these 4 patches fix the crash for me. Thanks for quick fix!
>
> Tested-by: Dmitry Vyukov <dvyukov@google.com>

Oops, resending as plain text.

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

crypto: use-after-free in hash_sock_destruct_common Dmitry Vyukov <dvyukov@google.com> - 2016-01-12 19:40 +0100
  crypto: af_alg - Allow af_af_alg_release_parent to be called on  nokey path Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:00 +0100
    [PATCH 4/4] crypto: af_alg - Forbid bind(2) when nokey child sockets  are present Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:10 +0100
    [PATCH 3/4] crypto: algif_skcipher - Remove custom release parent  function Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:10 +0100
    [PATCH 2/4] crypto: algif_hash - Remove custom release parent  function Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:10 +0100
  Re: crypto: use-after-free in hash_sock_destruct_common Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:00 +0100
    Re: crypto: use-after-free in hash_sock_destruct_common Dmitry Vyukov <dvyukov@google.com> - 2016-01-13 11:30 +0100

csiph-web