Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
kernel-fxtec-pro1x/crypto
History
Herbert Xu 9a8ecc6a3e crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 
commit 34c86f4c4a7be3b3e35aa48bd18299d4c756064d upstream.

The locking in af_alg_release_parent is broken as the BH socket
lock can only be taken if there is a code-path to handle the case
where the lock is owned by process-context.  Instead of adding
such handling, we can fix this by changing the ref counts to
atomic_t.

This patch also modifies the main refcnt to include both normal
and nokey sockets.  This way we don't have to fudge the nokey
ref count when a socket changes from nokey to normal.

Credits go to Mauricio Faria de Oliveira who diagnosed this bug
and sent a patch for it:

https://lore.kernel.org/linux-crypto/20200605161657.535043-1-mfo@canonical.com/

Reported-by: Brian Moyles <bmoyles@netflix.com>
Reported-by: Mauricio Faria de Oliveira <mfo@canonical.com>
Fixes: 37f96694cf73 ("crypto: af_alg - Use bh_lock_sock in...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-09 09:37:10 +02:00
..
asymmetric_keys crypto: asymmetric_keys - select CRYPTO_HASH where needed 2019-07-26 09:14:13 +02:00
async_tx
842.c
ablkcipher.c
acompress.c
aead.c crypto: aead - set CRYPTO_TFM_NEED_KEY if ->setkey() fails 2019-03-23 20:09:54 +01:00
aegis.h
aegis128.c crypto: aegis - fix handling chunked inputs 2019-03-23 20:09:54 +01:00
aegis128l.c crypto: aegis - fix handling chunked inputs 2019-03-23 20:09:54 +01:00
aegis256.c crypto: aegis - fix handling chunked inputs 2019-03-23 20:09:54 +01:00
aes_generic.c
aes_ti.c
af_alg.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-07-09 09:37:10 +02:00
ahash.c crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails 2019-03-23 20:09:54 +01:00
akcipher.c
algapi.c crypto: api - Fix race condition in crypto_spawn_alg 2020-02-11 04:34:05 -08:00
algboss.c crypto: algboss - don't wait during notifier callback 2020-06-25 15:33:09 +02:00
algif_aead.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-07-09 09:37:10 +02:00
algif_hash.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-07-09 09:37:10 +02:00
algif_rng.c
algif_skcipher.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-07-09 09:37:10 +02:00
ansi_cprng.c
anubis.c
api.c crypto: api - Fix race condition in crypto_spawn_alg 2020-02-11 04:34:05 -08:00
arc4.c
authenc.c
authencesn.c
blkcipher.c
blowfish_common.c
blowfish_generic.c
camellia_generic.c
cast5_generic.c
cast6_generic.c
cast_common.c
cbc.c
ccm.c crypto: ccm - fix incompatibility between "ccm" and "ccm_base" 2019-05-22 07:37:43 +02:00
cfb.c crypto: cfb - remove bogus memcpy() with src == dest 2019-03-23 20:09:40 +01:00
chacha20_generic.c crypto: chacha20 - Fix chacha20_block() keystream alignment (again) 2019-11-20 18:47:11 +01:00
chacha20poly1305.c crypto: chacha20poly1305 - fix atomic sleep when using async algorithm 2019-07-26 09:14:19 +02:00
cipher.c
cmac.c
compress.c
crc32_generic.c
crc32c_generic.c
crct10dif_common.c
crct10dif_generic.c crypto: crct10dif-generic - fix use via crypto_shash_digest() 2019-05-22 07:37:37 +02:00
cryptd.c crypto: cryptd - Fix skcipher instance memory leak 2019-07-10 09:53:41 +02:00
crypto_engine.c
crypto_null.c
crypto_user.c crypto: user - fix memory leak in crypto_report 2019-12-13 08:52:48 +01:00
crypto_wq.c
ctr.c
cts.c
deflate.c
des_generic.c
dh.c
dh_helper.c
drbg.c
ecb.c
ecc.c crypto: ecdh - fix big endian bug in ECC library 2019-12-13 08:52:48 +01:00
ecc.h
ecc_curve_defs.h
ecdh.c
ecdh_helper.c
echainiv.c
fcrypt.c
fips.c
gcm.c crypto: gcm - fix incompatibility between "gcm" and "gcm_base" 2019-05-22 07:37:37 +02:00
gf128mul.c
ghash-generic.c crypto: ghash - fix unaligned memory access in ghash_setkey() 2019-07-26 09:14:19 +02:00
hash_info.c
hmac.c
internal.h crypto: api - Fix race condition in crypto_spawn_alg 2020-02-11 04:34:05 -08:00
jitterentropy-kcapi.c
jitterentropy.c
Kconfig
keywrap.c
khazad.c
kpp.c
lrw.c gcc-10: avoid shadowing standard library 'free()' in crypto 2020-05-20 08:18:46 +02:00
lz4.c
lz4hc.c
lzo.c
Makefile
mcryptd.c
md4.c
md5.c
memneq.c
michael_mic.c
morus640.c crypto: morus - fix handling chunked inputs 2019-03-23 20:09:54 +01:00
morus1280.c crypto: morus - fix handling chunked inputs 2019-03-23 20:09:54 +01:00
pcbc.c crypto: pcbc - remove bogus memcpy()s with src == dest 2019-03-23 20:09:55 +01:00
pcrypt.c crypto: pcrypt - Do not clear MAY_SLEEP flag in original request 2020-02-11 04:34:05 -08:00
poly1305_generic.c
proc.c
ripemd.h
rmd128.c
rmd160.c
rmd256.c
rmd320.c
rng.c
rsa-pkcs1pad.c crypto: fix a memory leak in rsa-kcs1pad's encryption mode 2019-11-20 18:47:44 +01:00
rsa.c
rsa_helper.c
rsaprivkey.asn1
rsapubkey.asn1
salsa20_generic.c crypto: salsa20 - don't access already-freed walk.iv 2019-05-22 07:37:36 +02:00
scatterwalk.c
scompress.c
seed.c
seqiv.c
serpent_generic.c crypto: serpent - mark __serpent_setkey_sbox noinline 2019-07-26 09:14:13 +02:00
sha1_generic.c
sha3_generic.c
sha256_generic.c
sha512_generic.c
shash.c crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails 2019-03-23 20:09:54 +01:00
simd.c
skcipher.c crypto: skcipher - Unmap pages after an external error 2019-10-11 18:20:52 +02:00
sm3_generic.c
sm4_generic.c
tcrypt.c
tcrypt.h
tea.c
testmgr.c crypto: testmgr - fix sizeof() on COMP_BUF_SIZE 2019-12-01 09:16:13 +01:00
testmgr.h crypto: x86/poly1305 - fix overflow during partial reduction 2019-04-27 09:36:37 +02:00
tgr192.c crypto: tgr192 - fix unaligned memory access 2020-01-27 14:50:13 +01:00
twofish_common.c
twofish_generic.c
vmac.c
wp512.c
xcbc.c
xor.c
xts.c gcc-10: avoid shadowing standard library 'free()' in crypto 2020-05-20 08:18:46 +02:00
zstd.c