Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1382532 > unrolled thread

[PATCH 1/2] crypto: s5p-sss - Fix use after free of copied input buffer in error path

Back to article view | Back to linux.kernel

Contents

  [PATCH 1/2] crypto: s5p-sss - Fix use after free of copied input  buffer in error path Krzysztof Kozlowski <k.kozlowski@samsung.com> - 2016-04-19 15:50 +0200
    Re: [PATCH 1/2] crypto: s5p-sss - Fix use after free of copied input  buffer in error path Herbert Xu <herbert@gondor.apana.org.au> - 2016-04-20 12:00 +0200
    Re: [PATCH 1/2] crypto: s5p-sss - Fix use after free of copied input  buffer in error path Vladimir Zapolskiy <vz@mleia.com> - 2016-04-20 12:10 +0200

#1382532 — [PATCH 1/2] crypto: s5p-sss - Fix use after free of copied input buffer in error path

The driver makes copies of memory (input or output scatterlists) if they
are not aligned. In s5p_aes_crypt_start() error path (on unsuccessful
initialization of output scatterlist), if input scatterlist was not
aligned, the driver first freed copied input memory and then unmapped it
from the device, instead of doing otherwise (unmap and then free).

This was wrong in two ways:
1. Freed pages were still mapped to the device.
2. The dma_unmap_sg() iterated over freed scatterlist structure.

The call to s5p_free_sg_cpy() in this error path is not needed because
the copied scatterlists will be freed by s5p_aes_complete().

Fixes: 9e4a1100a445 ("crypto: s5p-sss - Handle unaligned buffers")
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
---
 drivers/crypto/s5p-sss.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
index 4f6d5b3ec418..b0484d4d68d9 100644
--- a/drivers/crypto/s5p-sss.c
+++ b/drivers/crypto/s5p-sss.c
@@ -577,7 +577,6 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
 	return;
 
 outdata_error:
-	s5p_free_sg_cpy(dev, &dev->sg_src_cpy);
 	s5p_unset_indata(dev);
 
 indata_error:
-- 
1.9.1

[toc] | [next] | [standalone]

#1383232

On Tue, Apr 19, 2016 at 03:44:11PM +0200, Krzysztof Kozlowski wrote:
> The driver makes copies of memory (input or output scatterlists) if they
> are not aligned. In s5p_aes_crypt_start() error path (on unsuccessful
> initialization of output scatterlist), if input scatterlist was not
> aligned, the driver first freed copied input memory and then unmapped it
> from the device, instead of doing otherwise (unmap and then free).
> 
> This was wrong in two ways:
> 1. Freed pages were still mapped to the device.
> 2. The dma_unmap_sg() iterated over freed scatterlist structure.
> 
> The call to s5p_free_sg_cpy() in this error path is not needed because
> the copied scatterlists will be freed by s5p_aes_complete().
> 
> Fixes: 9e4a1100a445 ("crypto: s5p-sss - Handle unaligned buffers")
> Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>

Both applied.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

[toc] | [prev] | [next] | [standalone]

#1383235

Hi Krzysztof,

On 19.04.2016 16:44, Krzysztof Kozlowski wrote:
> The driver makes copies of memory (input or output scatterlists) if they
> are not aligned. In s5p_aes_crypt_start() error path (on unsuccessful
> initialization of output scatterlist), if input scatterlist was not
> aligned, the driver first freed copied input memory and then unmapped it
> from the device, instead of doing otherwise (unmap and then free).
> 
> This was wrong in two ways:
> 1. Freed pages were still mapped to the device.
> 2. The dma_unmap_sg() iterated over freed scatterlist structure.
> 
> The call to s5p_free_sg_cpy() in this error path is not needed because
> the copied scatterlists will be freed by s5p_aes_complete().
> 
> Fixes: 9e4a1100a445 ("crypto: s5p-sss - Handle unaligned buffers")
> Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>

I see that Herbert have just applied the changes, but anyway I reviewed
them and they are good in my opinion.

Acked-by: Vladimir Zapolskiy <vz@mleia.com>

> ---
>  drivers/crypto/s5p-sss.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
> index 4f6d5b3ec418..b0484d4d68d9 100644
> --- a/drivers/crypto/s5p-sss.c
> +++ b/drivers/crypto/s5p-sss.c
> @@ -577,7 +577,6 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
>  	return;
>  
>  outdata_error:
> -	s5p_free_sg_cpy(dev, &dev->sg_src_cpy);
>  	s5p_unset_indata(dev);
>  
>  indata_error:
> 

--
With best wishes,
Vladimir

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web