Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1307739 > unrolled thread
| Started by | Dmitry Vyukov <dvyukov@google.com> |
|---|---|
| First post | 2016-01-12 19:40 +0100 |
| Last post | 2016-01-13 11:30 +0100 |
| Articles | 7 — 2 participants |
Back to article view | Back to linux.kernel
crypto: use-after-free in hash_sock_destruct_common Dmitry Vyukov <dvyukov@google.com> - 2016-01-12 19:40 +0100
crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:00 +0100
[PATCH 4/4] crypto: af_alg - Forbid bind(2) when nokey child sockets are present Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:10 +0100
[PATCH 3/4] crypto: algif_skcipher - Remove custom release parent function Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:10 +0100
[PATCH 2/4] crypto: algif_hash - Remove custom release parent function Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:10 +0100
Re: crypto: use-after-free in hash_sock_destruct_common Herbert Xu <herbert@gondor.apana.org.au> - 2016-01-13 08:00 +0100
Re: crypto: use-after-free in hash_sock_destruct_common Dmitry Vyukov <dvyukov@google.com> - 2016-01-13 11:30 +0100
| From | Dmitry Vyukov <dvyukov@google.com> |
|---|---|
| Date | 2016-01-12 19:40 +0100 |
| Subject | crypto: use-after-free in hash_sock_destruct_common |
| Message-ID | <qQc1k-4Ra-27@gated-at.bofh.it> |
Hello,
The following program triggers use-after-free in
hash_sock_destruct_common. This is on master of
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git
(cd7e98414462b9db70067ac29896c58210b13b69). I've also seen a similar
crash in skcipher_sock_destruct_common.
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <stdint.h>
#include <pthread.h>
int fd;
void *thr(void *arg)
{
switch ((long)arg) {
case 0:
break;
case 1:
break;
case 2:
*(uint16_t*)0x20023000 = (uint16_t)0x26;
memcpy((void*)0x20023002,
"\x68\x61\x73\x68\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 14);
*(uint32_t*)0x20023010 = (uint32_t)0x2000;
*(uint32_t*)0x20023014 = (uint32_t)0x84;
memcpy((void*)0x20023018,
"\x74\x67\x72\x31\x36\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
64);
syscall(SYS_bind, fd, 0x20023000ul, 0x58ul, 0, 0, 0);
break;
case 3:
syscall(SYS_accept, fd, 0x0ul, 0x2000affcul, 0, 0, 0);
break;
}
return 0;
}
int main()
{
long i;
pthread_t th[4];
fd = syscall(SYS_socket, 0x26ul, 0x5ul, 0x0ul, 0, 0, 0);
syscall(SYS_mmap, 0x20000000ul, 0x28000ul, 0x3ul, 0x32ul,
0xfffffffffffffffful, 0x0ul);
for (i = 0; i < 4; i++) {
pthread_create(&th[i], 0, thr, (void*)i);
usleep(10000);
}
for (i = 0; i < 4; i++) {
pthread_create(&th[i], 0, thr, (void*)i);
if (i%2==0)
usleep(10000);
}
usleep(100000);
return 0;
}
==================================================================
BUG: KASAN: use-after-free in hash_sock_destruct_common+0x12b/0x160 at
addr ffff880064550490
Read of size 8 by task a.out/6513
=============================================================================
BUG kmalloc-192 (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in crypto_create_tfm+0x7a/0x210 age=147 cpu=2 pid=6516
[< none >] __slab_alloc+0x535/0x5d0 mm/slub.c:2399
[< inline >] slab_alloc_node mm/slub.c:2467
[< inline >] slab_alloc mm/slub.c:2509
[< none >] __kmalloc+0x2cd/0x370 mm/slub.c:3414
[< inline >] kmalloc include/linux/slab.h:445
[< inline >] kzalloc include/linux/slab.h:593
[< none >] crypto_create_tfm+0x7a/0x210 crypto/api.c:470
[< none >] crypto_alloc_tfm+0x11d/0x330 crypto/api.c:555
[< none >] crypto_alloc_ahash+0x14/0x20 crypto/ahash.c:541
[< none >] hash_bind+0x66/0xe0 crypto/algif_hash.c:357
[< none >] alg_bind+0x179/0x3c0 crypto/af_alg.c:175
[< none >] SYSC_bind+0x1ae/0x210 net/socket.c:1383
[< none >] SyS_bind+0x9/0x10 net/socket.c:1369
[< none >] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
INFO: Freed in kzfree+0x28/0x30 age=121 cpu=3 pid=6520
[< none >] __slab_free+0x1e7/0x310 mm/slub.c:2584
[< inline >] slab_free mm/slub.c:2733
[< none >] kfree+0x29f/0x2c0 mm/slub.c:3514
[< none >] kzfree+0x28/0x30 mm/slab_common.c:1270
[< none >] crypto_destroy_tfm+0xac/0x150 crypto/api.c:596
[< inline >] crypto_free_ahash include/crypto/hash.h:259
[< none >] hash_release+0x2b/0x40 crypto/algif_hash.c:372
[< inline >] alg_do_release crypto/af_alg.c:118
[< none >] alg_bind+0x269/0x3c0 crypto/af_alg.c:196
[< none >] SYSC_bind+0x1ae/0x210 net/socket.c:1383
[< none >] SyS_bind+0x9/0x10 net/socket.c:1369
[< none >] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
INFO: Slab 0xffffea0001915400 objects=16 used=9 fp=0xffff880064550400
flags=0x5fffc0000004080
INFO: Object 0xffff880064550400 @offset=1024 fp=0xffff880064550e00
Bytes b4 ffff8800645503f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 ................
Object ffff880064550400: 00 0e 55 64 00 88 ff ff 00 00 00 00 00 00 00
00 ..Ud............
Object ffff880064550410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ................
Object ffff880064550420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ................
Object ffff880064550430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ................
Object ffff880064550440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ................
Object ffff880064550450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ................
Object ffff880064550460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ................
Object ffff880064550470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ................
Object ffff880064550480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ................
Object ffff880064550490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ................
Object ffff8800645504a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ................
Object ffff8800645504b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ................
Redzone ffff8800645504c0: bb bb bb bb bb bb bb bb
........
Padding ffff8800645505f8: 00 00 00 00 00 00 00 00
........
CPU: 1 PID: 6513 Comm: a.out Tainted: G B 4.4.0-rc1+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff880064550000 ffff8800340a7a88 ffffffff828b0ea7 ffff88003e804a00
ffff8800340a7ab8 ffffffff816fa734 ffff88003e804a00 ffffea0001915400
ffff880064550400 0000000000000000 ffff8800340a7ae0 ffffffff81700c9f
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff828b0ea7>] dump_stack+0x4b/0x64 lib/dump_stack.c:50
[<ffffffff816fa734>] print_trailer+0xf4/0x150 mm/slub.c:652
[<ffffffff81700c9f>] object_err+0x2f/0x40 mm/slub.c:659
[< inline >] print_address_description mm/kasan/report.c:138
[<ffffffff817034d6>] kasan_report_error+0x206/0x520 mm/kasan/report.c:236
[< inline >] kasan_report mm/kasan/report.c:259
[<ffffffff817038ee>] __asan_report_load8_noabort+0x3e/0x40
mm/kasan/report.c:280
[< inline >] crypto_ahash_digestsize include/crypto/hash.h:291
[<ffffffff827f12ab>] hash_sock_destruct_common+0x12b/0x160
crypto/algif_hash.c:393
[<ffffffff827f1e6d>] hash_sock_destruct_nokey+0xd/0x90 crypto/algif_hash.c:417
[<ffffffff84d122cf>] sk_destruct+0x3f/0x420 net/core/sock.c:1448
[<ffffffff84d126ff>] __sk_free+0x4f/0x1e0 net/core/sock.c:1476
[<ffffffff84d128a3>] sk_free+0x13/0x20 net/core/sock.c:1487
[< inline >] sock_put include/net/sock.h:1623
[<ffffffff827f035f>] af_alg_release+0x3f/0x50 crypto/af_alg.c:125
[<ffffffff84cfdaa3>] sock_release+0x83/0x1a0 net/socket.c:571
[<ffffffff84cfdbcd>] sock_close+0xd/0x20 net/socket.c:1022
[<ffffffff81749d70>] __fput+0x210/0x750 fs/file_table.c:208
[<ffffffff8174a319>] ____fput+0x9/0x10 fs/file_table.c:244
[<ffffffff81388992>] task_work_run+0x132/0x200 kernel/task_work.c:115
[< inline >] exit_task_work include/linux/task_work.h:21
[<ffffffff8133989b>] do_exit+0x7fb/0x2be0 kernel/exit.c:748
[<ffffffff8133bdb4>] do_group_exit+0xf4/0x2f0 kernel/exit.c:878
[< inline >] SYSC_exit_group kernel/exit.c:889
[<ffffffff8133bfc8>] SyS_exit_group+0x18/0x20 kernel/exit.c:887
[<ffffffff85e519f6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
Memory state around the buggy address:
ffff880064550380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff880064550400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff880064550480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff880064550500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff880064550580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
BUG: unable to handle kernel paging request at fffffffffffffff8
IP: [<ffffffff827f1238>] hash_sock_destruct_common+0xb8/0x160
crypto/algif_hash.c:392
PGD 6fa5067 PUD 6fa7067 PMD 0
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
Modules linked in:
CPU: 1 PID: 6513 Comm: a.out Tainted: G B 4.4.0-rc1+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880037bbc380 ti: ffff8800340a0000 task.ti: ffff8800340a0000
RIP: 0010:[<ffffffff827f1238>] [<ffffffff827f1238>]
hash_sock_destruct_common+0xb8/0x160
RSP: 0018:ffff8800340a7ba8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8800663740c0 RCX: 0000000000000000
RDX: 1fffffffffffffff RSI: 0000000000000001 RDI: ffff8800663743f0
RBP: ffff8800340a7bc8 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff861e0380 R11: 0000000000000000 R12: ffff880066373780
R13: 0000000000000000 R14: 0000000000000000 R15: ffff880067e92110
FS: 0000000000000000(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff8 CR3: 0000000006fa2000 CR4: 00000000000006e0
Stack:
0000000000000000 ffff880066373780 ffffffff8738c1e0 ffff8800665ff828
ffff8800340a7be0 ffffffff827f1e6d ffff880066373780 ffff8800340a7c08
ffffffff84d122cf ffff880066373780 ffffffff8738c1e0 ffff8800665ff828
Call Trace:
[<ffffffff827f1e6d>] hash_sock_destruct_nokey+0xd/0x90 crypto/algif_hash.c:417
[<ffffffff84d122cf>] sk_destruct+0x3f/0x420 net/core/sock.c:1448
[<ffffffff84d126ff>] __sk_free+0x4f/0x1e0 net/core/sock.c:1476
[<ffffffff84d128a3>] sk_free+0x13/0x20 net/core/sock.c:1487
[< inline >] sock_put include/net/sock.h:1623
[<ffffffff827f035f>] af_alg_release+0x3f/0x50 crypto/af_alg.c:125
[<ffffffff84cfdaa3>] sock_release+0x83/0x1a0 net/socket.c:571
[<ffffffff84cfdbcd>] sock_close+0xd/0x20 net/socket.c:1022
[<ffffffff81749d70>] __fput+0x210/0x750 fs/file_table.c:208
[<ffffffff8174a319>] ____fput+0x9/0x10 fs/file_table.c:244
[<ffffffff81388992>] task_work_run+0x132/0x200 kernel/task_work.c:115
[< inline >] exit_task_work include/linux/task_work.h:21
[<ffffffff8133989b>] do_exit+0x7fb/0x2be0 kernel/exit.c:748
[<ffffffff8133bdb4>] do_group_exit+0xf4/0x2f0 kernel/exit.c:878
[< inline >] SYSC_exit_group kernel/exit.c:889
[<ffffffff8133bfc8>] SyS_exit_group+0x18/0x20 kernel/exit.c:887
[<ffffffff85e519f6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
Code: fc ff df 49 8d 7d f8 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74
04 3c 03 7e 78 48 8d bb 30 03 00 00 48 b8 00 00 00 00 00 fc ff df <41>
8b 55 f8 48 89 f9 48 c1 e9 03 80 3c 01 00 75 7b 48 8b b3 30
RIP [<ffffffff827f1238>] hash_sock_destruct_common+0xb8/0x160
crypto/algif_hash.c:392
RSP <ffff8800340a7ba8>
CR2: fffffffffffffff8
---[ end trace 130c2827b1841caa ]---
Fixing recursive fault but reboot is needed!
[toc] | [next] | [standalone]
| From | Herbert Xu <herbert@gondor.apana.org.au> |
|---|---|
| Date | 2016-01-13 08:00 +0100 |
| Subject | crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path |
| Message-ID | <qQnzs-4iP-1@gated-at.bofh.it> |
| In reply to | #1307739 |
This patch allows af_alg_release_parent to be called even for
nokey sockets.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 6566d2e..e7cb836 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -133,6 +133,12 @@ void af_alg_release_parent(struct sock *sk)
bool last;
sk = ask->parent;
+
+ if (ask->nokey_refcnt && !ask->refcnt) {
+ sock_put(sk);
+ return;
+ }
+
ask = alg_sk(sk);
lock_sock(sk);
@@ -268,8 +274,8 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
struct alg_sock *ask = alg_sk(sk);
const struct af_alg_type *type;
struct sock *sk2;
+ unsigned int nokey;
int err;
- bool nokey;
lock_sock(sk);
type = ask->type;
@@ -302,6 +308,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
sock_hold(sk);
alg_sk(sk2)->parent = sk;
alg_sk(sk2)->type = type;
+ alg_sk(sk2)->nokey_refcnt = nokey;
newsock->ops = type->ops;
newsock->state = SS_CONNECTED;
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index df82844..a2bfd78 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -31,6 +31,7 @@ struct alg_sock {
struct sock *parent;
unsigned int refcnt;
+ unsigned int nokey_refcnt;
const struct af_alg_type *type;
void *private;
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
[toc] | [prev] | [next] | [standalone]
| From | Herbert Xu <herbert@gondor.apana.org.au> |
|---|---|
| Date | 2016-01-13 08:10 +0100 |
| Subject | [PATCH 4/4] crypto: af_alg - Forbid bind(2) when nokey child sockets are present |
| Message-ID | <qQnJ8-4Cb-9@gated-at.bofh.it> |
| In reply to | #1308091 |
This patch forbids the calling of bind(2) when there are child
sockets created by accept(2) in existence, even if they are created
on the nokey path.
This is needed as those child sockets have references to the tfm
object which bind(2) will destroy.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index e7cb836..f5e18c2 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -130,19 +130,16 @@ EXPORT_SYMBOL_GPL(af_alg_release);
void af_alg_release_parent(struct sock *sk)
{
struct alg_sock *ask = alg_sk(sk);
- bool last;
+ unsigned int nokey = ask->nokey_refcnt;
+ bool last = nokey && !ask->refcnt;
sk = ask->parent;
-
- if (ask->nokey_refcnt && !ask->refcnt) {
- sock_put(sk);
- return;
- }
-
ask = alg_sk(sk);
lock_sock(sk);
- last = !--ask->refcnt;
+ ask->nokey_refcnt -= nokey;
+ if (!last)
+ last = !--ask->refcnt;
release_sock(sk);
if (last)
@@ -188,7 +185,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
err = -EBUSY;
lock_sock(sk);
- if (ask->refcnt)
+ if (ask->refcnt | ask->nokey_refcnt)
goto unlock;
swap(ask->type, type);
@@ -306,6 +303,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
if (nokey || !ask->refcnt++)
sock_hold(sk);
+ ask->nokey_refcnt += nokey;
alg_sk(sk2)->parent = sk;
alg_sk(sk2)->type = type;
alg_sk(sk2)->nokey_refcnt = nokey;
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
[toc] | [prev] | [next] | [standalone]
| From | Herbert Xu <herbert@gondor.apana.org.au> |
|---|---|
| Date | 2016-01-13 08:10 +0100 |
| Subject | [PATCH 3/4] crypto: algif_skcipher - Remove custom release parent function |
| Message-ID | <qQnJ8-4Cb-13@gated-at.bofh.it> |
| In reply to | #1308091 |
This patch removes the custom release parent function as the
generic af_alg_release_parent now works for nokey sockets too.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 4a5bdb6..1f99d2d 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -895,7 +895,7 @@ static void skcipher_wait(struct sock *sk)
msleep(100);
}
-static void skcipher_sock_destruct_common(struct sock *sk)
+static void skcipher_sock_destruct(struct sock *sk)
{
struct alg_sock *ask = alg_sk(sk);
struct skcipher_ctx *ctx = ask->private;
@@ -907,33 +907,10 @@ static void skcipher_sock_destruct_common(struct sock *sk)
skcipher_free_sgl(sk);
sock_kzfree_s(sk, ctx->iv, crypto_skcipher_ivsize(tfm));
sock_kfree_s(sk, ctx, ctx->len);
-}
-
-static void skcipher_sock_destruct(struct sock *sk)
-{
- skcipher_sock_destruct_common(sk);
- af_alg_release_parent(sk);
-}
-
-static void skcipher_release_parent_nokey(struct sock *sk)
-{
- struct alg_sock *ask = alg_sk(sk);
-
- if (!ask->refcnt) {
- sock_put(ask->parent);
- return;
- }
-
af_alg_release_parent(sk);
}
-static void skcipher_sock_destruct_nokey(struct sock *sk)
-{
- skcipher_sock_destruct_common(sk);
- skcipher_release_parent_nokey(sk);
-}
-
-static int skcipher_accept_parent_common(void *private, struct sock *sk)
+static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
{
struct skcipher_ctx *ctx;
struct alg_sock *ask = alg_sk(sk);
@@ -981,21 +958,7 @@ static int skcipher_accept_parent(void *private, struct sock *sk)
if (!tfm->has_key && crypto_skcipher_has_setkey(tfm->skcipher))
return -ENOKEY;
- return skcipher_accept_parent_common(private, sk);
-}
-
-static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
-{
- int err;
-
- err = skcipher_accept_parent_common(private, sk);
- if (err)
- goto out;
-
- sk->sk_destruct = skcipher_sock_destruct_nokey;
-
-out:
- return err;
+ return skcipher_accept_parent_nokey(private, sk);
}
static const struct af_alg_type algif_type_skcipher = {
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
[toc] | [prev] | [next] | [standalone]
| From | Herbert Xu <herbert@gondor.apana.org.au> |
|---|---|
| Date | 2016-01-13 08:10 +0100 |
| Subject | [PATCH 2/4] crypto: algif_hash - Remove custom release parent function |
| Message-ID | <qQnJ8-4Cb-11@gated-at.bofh.it> |
| In reply to | #1308091 |
This patch removes the custom release parent function as the
generic af_alg_release_parent now works for nokey sockets too.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index 46637be..3653ab6 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -384,7 +384,7 @@ static int hash_setkey(void *private, const u8 *key, unsigned int keylen)
return err;
}
-static void hash_sock_destruct_common(struct sock *sk)
+static void hash_sock_destruct(struct sock *sk)
{
struct alg_sock *ask = alg_sk(sk);
struct hash_ctx *ctx = ask->private;
@@ -392,33 +392,10 @@ static void hash_sock_destruct_common(struct sock *sk)
sock_kzfree_s(sk, ctx->result,
crypto_ahash_digestsize(crypto_ahash_reqtfm(&ctx->req)));
sock_kfree_s(sk, ctx, ctx->len);
-}
-
-static void hash_sock_destruct(struct sock *sk)
-{
- hash_sock_destruct_common(sk);
- af_alg_release_parent(sk);
-}
-
-static void hash_release_parent_nokey(struct sock *sk)
-{
- struct alg_sock *ask = alg_sk(sk);
-
- if (!ask->refcnt) {
- sock_put(ask->parent);
- return;
- }
-
af_alg_release_parent(sk);
}
-static void hash_sock_destruct_nokey(struct sock *sk)
-{
- hash_sock_destruct_common(sk);
- hash_release_parent_nokey(sk);
-}
-
-static int hash_accept_parent_common(void *private, struct sock *sk)
+static int hash_accept_parent_nokey(void *private, struct sock *sk)
{
struct hash_ctx *ctx;
struct alg_sock *ask = alg_sk(sk);
@@ -461,21 +438,7 @@ static int hash_accept_parent(void *private, struct sock *sk)
if (!tfm->has_key && crypto_ahash_has_setkey(tfm->hash))
return -ENOKEY;
- return hash_accept_parent_common(private, sk);
-}
-
-static int hash_accept_parent_nokey(void *private, struct sock *sk)
-{
- int err;
-
- err = hash_accept_parent_common(private, sk);
- if (err)
- goto out;
-
- sk->sk_destruct = hash_sock_destruct_nokey;
-
-out:
- return err;
+ return hash_accept_parent_nokey(private, sk);
}
static const struct af_alg_type algif_type_hash = {
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
[toc] | [prev] | [next] | [standalone]
| From | Herbert Xu <herbert@gondor.apana.org.au> |
|---|---|
| Date | 2016-01-13 08:00 +0100 |
| Message-ID | <qQnzs-4iP-3@gated-at.bofh.it> |
| In reply to | #1307739 |
On Tue, Jan 12, 2016 at 07:31:03PM +0100, Dmitry Vyukov wrote: > > The following program triggers use-after-free in > hash_sock_destruct_common. This is on master of > git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git > (cd7e98414462b9db70067ac29896c58210b13b69). I've also seen a similar > crash in skcipher_sock_destruct_common. OK the new compatibility nokey path introduced some new problems. Please try the following patches. Thanks, -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
[toc] | [prev] | [next] | [standalone]
| From | Dmitry Vyukov <dvyukov@google.com> |
|---|---|
| Date | 2016-01-13 11:30 +0100 |
| Message-ID | <qQqQG-6Le-27@gated-at.bofh.it> |
| In reply to | #1308095 |
On Wed, Jan 13, 2016 at 11:25 AM, Dmitry Vyukov <dvyukov@google.com> wrote: > On Wed, Jan 13, 2016 at 7:57 AM, Herbert Xu <herbert@gondor.apana.org.au> > wrote: >> >> On Tue, Jan 12, 2016 at 07:31:03PM +0100, Dmitry Vyukov wrote: >> > >> > The following program triggers use-after-free in >> > hash_sock_destruct_common. This is on master of >> > git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git >> > (cd7e98414462b9db70067ac29896c58210b13b69). I've also seen a similar >> > crash in skcipher_sock_destruct_common. >> >> OK the new compatibility nokey path introduced some new problems. >> Please try the following patches. > > > Yes, these 4 patches fix the crash for me. Thanks for quick fix! > > Tested-by: Dmitry Vyukov <dvyukov@google.com> Oops, resending as plain text.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web