Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

crypto: do not free algorithm before using

Browse source 
commit e5bde04ccce64d808f8b00a489a1fe5825d285cb upstream.

In multiple functions, the algorithm fields are read after its reference
is dropped through crypto_mod_put. In this case, the algorithm memory
may be freed, resulting in use-after-free bugs. This patch delays the
put operation until the algorithm is never used.

Fixes: 79c65d179a ("crypto: cbc - Convert to skcipher")
Fixes: a7d85e06ed ("crypto: cfb - add support for Cipher FeedBack mode")
Fixes: 043a44001b ("crypto: pcbc - Convert to skcipher")
Cc: <stable@vger.kernel.org>
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Pan Bian 2018-11-22 18:00:16 +08:00 committed by Greg Kroah-Hartman
parent 3592928146
commit 2f94605195
3 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
crypto/cbc.c
View file

@ -140,9 +140,8 @@ static int crypto_cbc_create(struct crypto_template *tmpl, struct rtattr **tb)
spawn = skcipher_instance_ctx(inst); spawn = skcipher_instance_ctx(inst);
err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst), err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
CRYPTO_ALG_TYPE_MASK); CRYPTO_ALG_TYPE_MASK);
crypto_mod_put(alg);
if (err) if (err)
goto err_free_inst; goto err_put_alg;
err = crypto_inst_setname(skcipher_crypto_instance(inst), "cbc", alg); err = crypto_inst_setname(skcipher_crypto_instance(inst), "cbc", alg);
if (err) if (err)
@ -174,12 +173,15 @@ static int crypto_cbc_create(struct crypto_template *tmpl, struct rtattr **tb)
err = skcipher_register_instance(tmpl, inst); err = skcipher_register_instance(tmpl, inst);
if (err) if (err)
goto err_drop_spawn; goto err_drop_spawn;
crypto_mod_put(alg);
out: out:
return err; return err;
err_drop_spawn: err_drop_spawn:
crypto_drop_spawn(spawn); crypto_drop_spawn(spawn);
err_put_alg:
crypto_mod_put(alg);
err_free_inst: err_free_inst:
kfree(inst); kfree(inst);
goto out; goto out;

6
crypto/cfb.c
View file

@ -286,9 +286,8 @@ static int crypto_cfb_create(struct crypto_template *tmpl, struct rtattr **tb)
spawn = skcipher_instance_ctx(inst); spawn = skcipher_instance_ctx(inst);
err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst), err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
CRYPTO_ALG_TYPE_MASK); CRYPTO_ALG_TYPE_MASK);
crypto_mod_put(alg);
if (err) if (err)
goto err_free_inst; goto err_put_alg;
err = crypto_inst_setname(skcipher_crypto_instance(inst), "cfb", alg); err = crypto_inst_setname(skcipher_crypto_instance(inst), "cfb", alg);
if (err) if (err)
@ -317,12 +316,15 @@ static int crypto_cfb_create(struct crypto_template *tmpl, struct rtattr **tb)
err = skcipher_register_instance(tmpl, inst); err = skcipher_register_instance(tmpl, inst);
if (err) if (err)
goto err_drop_spawn; goto err_drop_spawn;
crypto_mod_put(alg);
out: out:
return err; return err;
err_drop_spawn: err_drop_spawn:
crypto_drop_spawn(spawn); crypto_drop_spawn(spawn);
err_put_alg:
crypto_mod_put(alg);
err_free_inst: err_free_inst:
kfree(inst); kfree(inst);
goto out; goto out;

6
crypto/pcbc.c
View file

@ -244,9 +244,8 @@ static int crypto_pcbc_create(struct crypto_template *tmpl, struct rtattr **tb)
spawn = skcipher_instance_ctx(inst); spawn = skcipher_instance_ctx(inst);
err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst), err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
CRYPTO_ALG_TYPE_MASK); CRYPTO_ALG_TYPE_MASK);
crypto_mod_put(alg);
if (err) if (err)
goto err_free_inst; goto err_put_alg;
err = crypto_inst_setname(skcipher_crypto_instance(inst), "pcbc", alg); err = crypto_inst_setname(skcipher_crypto_instance(inst), "pcbc", alg);
if (err) if (err)
@ -275,12 +274,15 @@ static int crypto_pcbc_create(struct crypto_template *tmpl, struct rtattr **tb)
err = skcipher_register_instance(tmpl, inst); err = skcipher_register_instance(tmpl, inst);
if (err) if (err)
goto err_drop_spawn; goto err_drop_spawn;
crypto_mod_put(alg);
out: out:
return err; return err;
err_drop_spawn: err_drop_spawn:
crypto_drop_spawn(spawn); crypto_drop_spawn(spawn);
err_put_alg:
crypto_mod_put(alg);
err_free_inst: err_free_inst:
kfree(inst); kfree(inst);
goto out; goto out;