1
0
Fork 0
alistair23-linux/crypto
Herbert Xu 34c86f4c4a crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()
The locking in af_alg_release_parent is broken as the BH socket
lock can only be taken if there is a code-path to handle the case
where the lock is owned by process-context.  Instead of adding
such handling, we can fix this by changing the ref counts to
atomic_t.

This patch also modifies the main refcnt to include both normal
and nokey sockets.  This way we don't have to fudge the nokey
ref count when a socket changes from nokey to normal.

Credits go to Mauricio Faria de Oliveira who diagnosed this bug
and sent a patch for it:

https://lore.kernel.org/linux-crypto/20200605161657.535043-1-mfo@canonical.com/

Reported-by: Brian Moyles <bmoyles@netflix.com>
Reported-by: Mauricio Faria de Oliveira <mfo@canonical.com>
Fixes: 37f96694cf ("crypto: af_alg - Use bh_lock_sock in...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2020-06-18 17:09:54 +10:00
..
asymmetric_keys KEYS: asymmetric: return ENOMEM if akcipher_request_alloc() fails 2019-12-12 23:45:16 +02:00
async_tx treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 335 2019-06-05 17:37:06 +02:00
842.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
Kconfig Merge branch 'rwonce/rework' of git://git.kernel.org/pub/scm/linux/kernel/git/will/linux 2020-06-10 14:46:54 -07:00
Makefile crypto: ablkcipher - remove deprecated and unused ablkcipher support 2019-11-17 09:02:49 +08:00
acompress.c crypto: algapi - make unregistration functions return void 2019-12-20 14:58:35 +08:00
adiantum.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2020-01-28 15:38:56 -08:00
aead.c crypto: algapi - enforce that all instances have a ->free() method 2020-01-09 11:30:58 +08:00
aegis.h crypto: aegis128 - Fix -Wunused-const-variable warning 2019-08-30 18:05:30 +10:00
aegis128-core.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
aegis128-neon-inner.c crypto: aegis128 - duplicate init() and final() hooks in SIMD code 2019-10-26 02:06:05 +11:00
aegis128-neon.c crypto: aegis128 - duplicate init() and final() hooks in SIMD code 2019-10-26 02:06:05 +11:00
aes_generic.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
aes_ti.c crypto: aes - create AES library based on the fixed time AES code 2019-07-26 14:55:33 +10:00
af_alg.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-06-18 17:09:54 +10:00
ahash.c crypto: algapi - enforce that all instances have a ->free() method 2020-01-09 11:30:58 +08:00
akcipher.c crypto: algapi - enforce that all instances have a ->free() method 2020-01-09 11:30:58 +08:00
algapi.c crypto: algapi - create function to add request in front of queue 2020-05-08 15:30:40 +10:00
algboss.c crypto: algboss - don't wait during notifier callback 2020-06-15 17:38:54 +10:00
algif_aead.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-06-18 17:09:54 +10:00
algif_hash.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-06-18 17:09:54 +10:00
algif_rng.c crypto: algif_rng - remove redundant assignment to variable err 2020-04-24 17:42:16 +10:00
algif_skcipher.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-06-18 17:09:54 +10:00
ansi_cprng.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 42 2019-05-24 17:27:12 +02:00
anubis.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
api.c crypto: api - Fix use-after-free and race in crypto_spawn_alg 2020-04-16 16:49:22 +10:00
arc4.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
authenc.c crypto: authenc - use crypto_grab_ahash() and simplify error paths 2020-01-09 11:30:55 +08:00
authencesn.c crypto: authencesn - fix weird comma-terminated line 2020-03-06 12:28:22 +11:00
blake2b_generic.c crypto: blake2b - Fix clang optimization for ARMv7-M 2020-05-15 16:15:00 +10:00
blake2s_generic.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
blowfish_common.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
blowfish_generic.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
camellia_generic.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
cast5_generic.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 140 2019-05-30 11:25:16 -07:00
cast6_generic.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
cast_common.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 44 2019-05-24 17:27:12 +02:00
cbc.c crypto: skcipher - Add skcipher_ialg_simple helper 2019-12-27 18:18:04 +08:00
ccm.c crypto: ccm - simplify error handling in crypto_rfc4309_create() 2020-03-06 12:28:22 +11:00
cfb.c crypto: skcipher - Add skcipher_ialg_simple helper 2019-12-27 18:18:04 +08:00
chacha20poly1305.c crypto: chacha20poly1305 - use crypto_grab_ahash() and simplify error paths 2020-01-09 11:30:56 +08:00
chacha_generic.c crypto: chacha_generic - remove unnecessary setkey() functions 2019-11-22 18:48:39 +08:00
cipher.c crypto: remove propagation of CRYPTO_TFM_RES_* flags 2020-01-09 11:30:53 +08:00
cmac.c crypto: shash - convert shash_free_instance() to new style 2020-01-09 11:30:57 +08:00
compress.c crypto: compress - remove crt_u.compress (struct compress_tfm) 2019-12-11 16:37:01 +08:00
crc32_generic.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
crc32c_generic.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
crct10dif_common.c crypto: crct10dif - Add fallback for broken initrds 2013-09-12 15:31:34 +10:00
crct10dif_generic.c crypto: run initcalls for generic implementations earlier 2019-04-18 22:15:03 +08:00
cryptd.c crypto: cryptd - simplify error handling in cryptd_create_*() 2020-03-06 12:28:22 +11:00
crypto_engine.c crypto: engine - do not requeue in case of fatal error 2020-05-28 17:27:52 +10:00
crypto_null.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
crypto_user_base.c crypto: algapi - make unregistration functions return void 2019-12-20 14:58:35 +08:00
crypto_user_stat.c crypto: skcipher - remove the "blkcipher" algorithm type 2019-11-01 13:38:32 +08:00
ctr.c crypto: ctr - simplify error handling in crypto_rfc3686_create() 2020-03-06 12:28:22 +11:00
cts.c crypto: cts - simplify error handling in crypto_cts_create() 2020-03-06 12:28:23 +11:00
curve25519-generic.c crypto: curve25519 - implement generic KPP driver 2019-11-17 09:02:43 +08:00
deflate.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
des_generic.c crypto: remove CRYPTO_TFM_RES_WEAK_KEY 2020-01-09 11:30:53 +08:00
dh.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
dh_helper.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
drbg.c crypto: drbg - always try to free Jitter RNG instance 2020-06-15 17:38:54 +10:00
ecb.c crypto: skcipher - Add skcipher_ialg_simple helper 2019-12-27 18:18:04 +08:00
ecc.c int128: move __uint128_t compiler test to Kconfig 2019-11-17 09:02:42 +08:00
ecc.h crypto: ecrdsa - add EC-RDSA (GOST 34.10) algorithm 2019-04-18 22:15:02 +08:00
ecc_curve_defs.h crypto: ecc - make ecc into separate module 2019-04-18 22:15:02 +08:00
ecdh.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ecdh_helper.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
echainiv.c crypto: geniv - convert to new way of freeing instances 2020-01-09 11:30:57 +08:00
ecrdsa.c crypto: ecrdsa - add EC-RDSA (GOST 34.10) algorithm 2019-04-18 22:15:02 +08:00
ecrdsa_defs.h crypto: ecrdsa - add EC-RDSA (GOST 34.10) algorithm 2019-04-18 22:15:02 +08:00
ecrdsa_params.asn1 crypto: ecrdsa - add EC-RDSA (GOST 34.10) algorithm 2019-04-18 22:15:02 +08:00
ecrdsa_pub_key.asn1 crypto: ecrdsa - add EC-RDSA (GOST 34.10) algorithm 2019-04-18 22:15:02 +08:00
essiv.c crypto: essiv - use crypto_shash_tfm_digest() 2020-05-08 15:32:13 +10:00
fcrypt.c crypto: make all generic algorithms set cra_driver_name 2019-06-13 14:31:39 +08:00
fips.c crypto: fips - add FIPS test failure notification chain 2019-07-26 14:51:57 +10:00
gcm.c crypto: gcm - simplify error handling in crypto_rfc4543_create() 2020-03-06 12:28:23 +11:00
geniv.c crypto: geniv - simply error handling in aead_geniv_alloc() 2020-03-06 12:28:23 +11:00
gf128mul.c crypto: gf128mul - remove incorrect comment 2017-12-22 19:52:40 +11:00
ghash-generic.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
hash_info.c crypto: rename sm3-256 to sm3 in hash_algo_name 2020-02-18 07:35:49 -05:00
hmac.c crypto: shash - convert shash_free_instance() to new style 2020-01-09 11:30:57 +08:00
internal.h crypto: api - Fix use-after-free and race in crypto_spawn_alg 2020-04-16 16:49:22 +10:00
jitterentropy-kcapi.c crypto: jitter - SP800-90B compliance 2020-04-24 17:42:17 +10:00
jitterentropy.c crypto: jitter - SP800-90B compliance 2020-04-24 17:42:17 +10:00
jitterentropy.h crypto: jitter - add header to fix buildwarnings 2019-10-18 18:49:40 +11:00
keywrap.c crypto: skcipher - Add skcipher_ialg_simple helper 2019-12-27 18:18:04 +08:00
khazad.c crypto: make all generic algorithms set cra_driver_name 2019-06-13 14:31:39 +08:00
kpp.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
lrw.c crypto - Avoid free() namespace collision 2020-05-08 15:30:41 +10:00
lz4.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
lz4hc.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
lzo-rle.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
lzo.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
md4.c crypto: make all generic algorithms set cra_driver_name 2019-06-13 14:31:39 +08:00
md5.c crypto: md5 - remove unused macros 2020-02-28 08:43:21 +08:00
memneq.c crypto: memneq - fix for archs without efficient unaligned access 2013-12-09 20:09:12 +08:00
michael_mic.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
nhpoly1305.c crypto: poly1305 - add new 32 and 64-bit generic versions 2020-01-16 15:18:12 +08:00
ofb.c crypto: skcipher - Add skcipher_ialg_simple helper 2019-12-27 18:18:04 +08:00
pcbc.c crypto: skcipher - Add skcipher_ialg_simple helper 2019-12-27 18:18:04 +08:00
pcrypt.c crypto: pcrypt - simplify error handling in pcrypt_create_aead() 2020-03-06 12:28:24 +11:00
poly1305_generic.c crypto: poly1305 - add new 32 and 64-bit generic versions 2020-01-16 15:18:12 +08:00
proc.c crypto: proc - simplify the c_show function 2020-02-13 17:05:26 +08:00
ripemd.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rmd128.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
rmd160.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
rmd256.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
rmd320.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
rng.c crypto: rng - Fix a refcounting bug in crypto_rng_reset() 2020-02-13 16:58:09 +08:00
rsa-pkcs1pad.c crypto: rsa-pkcs1pad - simplify error handling in pkcs1pad_create() 2020-03-06 12:28:24 +11:00
rsa.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
rsa_helper.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
rsaprivkey.asn1 crypto: rsa - Store rest of the private key components 2016-07-05 23:05:26 +08:00
rsapubkey.asn1 crypto: akcipher - Changes to asymmetric key API 2015-10-14 22:23:16 +08:00
salsa20_generic.c crypto: run initcalls for generic implementations earlier 2019-04-18 22:15:03 +08:00
scatterwalk.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
scompress.c crypto: algapi - make unregistration functions return void 2019-12-20 14:58:35 +08:00
seed.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
seqiv.c crypto: geniv - convert to new way of freeing instances 2020-01-09 11:30:57 +08:00
serpent_generic.c crypto: x86 - Regularize glue function prototypes 2019-12-11 16:36:54 +08:00
sha1_generic.c crypto: lib/sha1 - fold linux/cryptohash.h into crypto/sha.h 2020-05-08 15:32:17 +10:00
sha3_generic.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
sha256_generic.c crypto: lib/sha256 - return void 2020-05-08 15:32:12 +10:00
sha512_generic.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 45 2019-05-24 17:27:12 +02:00
shash.c crypto: hash - introduce crypto_shash_tfm_digest() 2020-05-08 15:32:12 +10:00
simd.c crypto: remove propagation of CRYPTO_TFM_RES_* flags 2020-01-09 11:30:53 +08:00
skcipher.c crypto: algapi - enforce that all instances have a ->free() method 2020-01-09 11:30:58 +08:00
sm3_generic.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234 2019-06-19 17:09:07 +02:00
sm4_generic.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
streebog_generic.c crypto: streebog - remove two unused variables 2019-08-15 21:52:14 +10:00
tcrypt.c crypto: tcrypt - fix printed skcipher [a]sync mode 2020-02-13 17:05:26 +08:00
tcrypt.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
tea.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00
testmgr.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2020-04-01 14:47:40 -07:00
testmgr.h crypto: testmgr - generate inauthentic AEAD test vectors 2019-12-11 16:37:01 +08:00
tgr192.c crypto: tgr192 - remove unneeded semicolon 2019-11-15 13:44:17 +08:00
twofish_common.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
twofish_generic.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
vmac.c crypto: shash - convert shash_free_instance() to new style 2020-01-09 11:30:57 +08:00
wp512.c crypto: make all generic algorithms set cra_driver_name 2019-06-13 14:31:39 +08:00
xcbc.c crypto: shash - convert shash_free_instance() to new style 2020-01-09 11:30:57 +08:00
xor.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 47 2019-05-24 17:27:13 +02:00
xts.c crypto - Avoid free() namespace collision 2020-05-08 15:30:41 +10:00
xxhash_generic.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
zstd.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-08 20:57:08 -07:00