Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
kernel-fxtec-pro1x/crypto
History
Eric Biggers 9a00674213 crypto: algapi - fix NULL dereference in crypto_remove_spawns() 
syzkaller triggered a NULL pointer dereference in crypto_remove_spawns()
via a program that repeatedly and concurrently requests AEADs
"authenc(cmac(des3_ede-asm),pcbc-aes-aesni)" and hashes "cmac(des3_ede)"
through AF_ALG, where the hashes are requested as "untested"
(CRYPTO_ALG_TESTED is set in ->salg_mask but clear in ->salg_feat; this
causes the template to be instantiated for every request).

Although AF_ALG users really shouldn't be able to request an "untested"
algorithm, the NULL pointer dereference is actually caused by a
longstanding race condition where crypto_remove_spawns() can encounter
an instance which has had spawn(s) "grabbed" but hasn't yet been
registered, resulting in ->cra_users still being NULL.

We probably should properly initialize ->cra_users earlier, but that
would require updating many templates individually.  For now just fix
the bug in a simple way that can easily be backported: make
crypto_remove_spawns() treat a NULL ->cra_users list as empty.

Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2018-01-05 18:41:52 +11:00
..
asymmetric_keys X.509: fix comparisons of ->pkey_algo 2017-12-08 15:13:29 +00:00
async_tx License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
.gitignore
842.c
ablk_helper.c
ablkcipher.c
acompress.c crypto: acomp - allow registration of multiple acomps 2017-04-21 20:30:50 +08:00
aead.c
aes_generic.c
aes_ti.c crypto: aes_ti - fix comment for MixColumns step 2017-06-19 14:11:53 +08:00
af_alg.c crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t 2017-12-22 19:02:40 +11:00
ahash.c crypto: remove redundant backlog checks on EBUSY 2017-11-03 22:11:17 +08:00
akcipher.c
algapi.c crypto: algapi - fix NULL dereference in crypto_remove_spawns() 2018-01-05 18:41:52 +11:00
algboss.c crypto: algboss - remove redundant setting of len to zero 2017-10-07 12:10:34 +08:00
algif_aead.c crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t 2017-12-22 19:02:40 +11:00
algif_hash.c crypto: algif - move to generic async completion 2017-11-03 22:11:18 +08:00
algif_rng.c
algif_skcipher.c crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t 2017-12-22 19:02:40 +11:00
ansi_cprng.c
anubis.c
api.c crypto: introduce crypto wait for async op 2017-11-03 22:11:18 +08:00
arc4.c
authenc.c
authencesn.c crypto: authencesn - Fix digest_null crash 2017-07-18 17:01:11 +08:00
blkcipher.c
blowfish_common.c
blowfish_generic.c
camellia_generic.c
cast5_generic.c
cast6_generic.c
cast_common.c
cbc.c
ccm.c crypto: ccm - preserve the IV buffer 2017-11-03 21:35:35 +08:00
chacha20_generic.c crypto: chacha20 - fix handling of chunked input 2017-08-22 14:45:47 +08:00
chacha20poly1305.c crypto: chacha20poly1305 - validate the digest size 2017-12-22 19:02:33 +11:00
cipher.c
cmac.c
compress.c
crc32_generic.c
crc32c_generic.c
crct10dif_common.c
crct10dif_generic.c
cryptd.c crypto: change transient busy return code to -ENOSPC 2017-11-03 22:11:16 +08:00
crypto_engine.c crypto: engine - replace pr_xxx by dev_xxx 2017-06-19 14:19:54 +08:00
crypto_null.c
crypto_user.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2017-05-02 16:40:27 -07:00
crypto_wq.c
ctr.c crypto: algapi - make crypto_xor() take separate dst and src arguments 2017-08-04 09:27:15 +08:00
cts.c crypto: remove redundant backlog checks on EBUSY 2017-11-03 22:11:17 +08:00
deflate.c crypto: scomp - add support for deflate rfc1950 (zlib) 2017-04-24 18:11:08 +08:00
des_generic.c
dh.c crypto: dh - Remove pointless checks for NULL 'p' and 'g' 2017-11-10 19:20:22 +08:00
dh_helper.c crypto: dh - Don't permit 'key' or 'g' size longer than 'p' 2017-11-10 19:20:17 +08:00
drbg.c crypto: drbg - move to generic async completion 2017-11-03 22:11:19 +08:00
ecb.c
ecc.c crypto: ecdh - add privkey generation support 2017-06-10 12:04:35 +08:00
ecc.h crypto: ecdh - add privkey generation support 2017-06-10 12:04:35 +08:00
ecc_curve_defs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ecdh.c crypto: ecdh - remove empty exit() 2017-11-06 14:45:04 +08:00
ecdh_helper.c crypto: ecdh - return unsigned value for crypto_ecdh_key_len() 2017-10-12 22:55:00 +08:00
echainiv.c
fcrypt.c
fips.c
gcm.c crypto: gcm - move to generic async completion 2017-11-03 22:11:19 +08:00
gf128mul.c crypto: gf128mul - The x8_ble multiplication functions 2017-11-03 21:50:43 +08:00
ghash-generic.c
hash_info.c
hmac.c crypto: hmac - add hmac IPAD/OPAD constant 2017-05-23 12:52:05 +08:00
internal.h
jitterentropy-kcapi.c
jitterentropy.c
Kconfig Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2017-11-14 10:52:09 -08:00
keywrap.c crypto: keywrap - simplify code 2017-10-12 22:55:06 +08:00
khazad.c
kpp.c
lrw.c crypto: remove redundant backlog checks on EBUSY 2017-11-03 22:11:17 +08:00
lz4.c crypto: lz4 - fixed decompress function to return error code 2017-04-10 19:17:27 +08:00
lz4hc.c crypto: lz4 - fixed decompress function to return error code 2017-04-10 19:17:27 +08:00
lzo.c treewide: use kv[mz]alloc* rather than opencoded variants 2017-05-08 17:15:13 -07:00
Makefile Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2017-11-14 10:52:09 -08:00
mcryptd.c crypto: mcryptd - protect the per-CPU queue with a lock 2017-12-11 22:29:54 +11:00
md4.c
md5.c
memneq.c
michael_mic.c
pcbc.c crypto: algapi - make crypto_xor() take separate dst and src arguments 2017-08-04 09:27:15 +08:00
pcrypt.c crypto: pcrypt - fix freeing pcrypt instances 2017-12-22 19:02:47 +11:00
poly1305_generic.c
proc.c
ripemd.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rmd128.c crypto: drop unnecessary return statements 2017-09-22 17:43:28 +08:00
rmd160.c crypto: drop unnecessary return statements 2017-09-22 17:43:28 +08:00
rmd256.c crypto: drop unnecessary return statements 2017-09-22 17:43:28 +08:00
rmd320.c crypto: drop unnecessary return statements 2017-09-22 17:43:28 +08:00
rng.c crypto: rng - ensure that the RNG is ready before using 2017-07-28 17:56:00 +08:00
rsa-pkcs1pad.c crypto: remove redundant backlog checks on EBUSY 2017-11-03 22:11:17 +08:00
rsa.c crypto: rsa - comply with crypto_akcipher_maxsize() 2017-06-10 12:04:30 +08:00
rsa_helper.c
rsaprivkey.asn1
rsapubkey.asn1
salsa20_generic.c
scatterwalk.c
scompress.c crypto: scompress - defer allocation of scratch buffer to first use 2017-08-03 13:52:44 +08:00
seed.c
seqiv.c
serpent_generic.c crypto: serpent - improve __serpent_setkey with UBSAN 2017-08-09 20:17:54 +08:00
sha1_generic.c
sha3_generic.c
sha256_generic.c
sha512_generic.c
shash.c crypto: shash - Fix zero-length shash ahash digest crash 2017-10-11 00:34:07 +08:00
simd.c
skcipher.c crypto: skcipher - set walk.iv for zero-length inputs 2017-12-11 22:29:53 +11:00
sm3_generic.c crypto: sm3 - add OSCCA SM3 secure hash 2017-09-22 17:43:07 +08:00
tcrypt.c crypto: tcrypt - move to generic async completion 2017-11-03 22:11:22 +08:00
tcrypt.h
tea.c
testmgr.c crypto: testmgr - move to generic async completion 2017-11-03 22:11:19 +08:00
testmgr.h crypto: sm3 - add SM3 test vectors 2017-09-22 17:43:08 +08:00
tgr192.c
twofish_common.c
twofish_generic.c
vmac.c
wp512.c
xcbc.c
xor.c kmemcheck: stop using GFP_NOTRACK and SLAB_NOTRACK 2017-11-15 18:21:04 -08:00
xts.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2017-11-14 10:52:09 -08:00