From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S937055AbdDSPTD (ORCPT ); Wed, 19 Apr 2017 11:19:03 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:46008 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935270AbdDSOjw (ORCPT ); Wed, 19 Apr 2017 10:39:52 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Royce , Krzysztof Kozlowski , Herbert Xu Subject: [PATCH 4.10 57/69] crypto: xts - Fix use-after-free on EINPROGRESS Date: Wed, 19 Apr 2017 16:37:26 +0200 Message-Id: <20170419141557.485915536@linuxfoundation.org> X-Mailer: git-send-email 2.12.2 In-Reply-To: <20170419141555.114738231@linuxfoundation.org> References: <20170419141555.114738231@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Herbert Xu commit aa4a829bdaced81e70c215a84ef6595ce8bd4308 upstream. When we get an EINPROGRESS completion in xts, we will end up marking the request as done and freeing it. This then blows up when the request is really completed as we've already freed the memory. Fixes: f1c131b45410 ("crypto: xts - Convert to skcipher") Reported-by: Nathan Royce Reported-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu Tested-by: Krzysztof Kozlowski Signed-off-by: Greg Kroah-Hartman --- crypto/xts.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) --- a/crypto/xts.c +++ b/crypto/xts.c @@ -286,6 +286,13 @@ static void encrypt_done(struct crypto_a struct rctx *rctx; rctx = skcipher_request_ctx(req); + + if (err == -EINPROGRESS) { + if (rctx->left != req->cryptlen) + return; + goto out; + } + subreq = &rctx->subreq; subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; @@ -293,6 +300,7 @@ static void encrypt_done(struct crypto_a if (rctx->left) return; +out: skcipher_request_complete(req, err); } @@ -330,6 +338,13 @@ static void decrypt_done(struct crypto_a struct rctx *rctx; rctx = skcipher_request_ctx(req); + + if (err == -EINPROGRESS) { + if (rctx->left != req->cryptlen) + return; + goto out; + } + subreq = &rctx->subreq; subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; @@ -337,6 +352,7 @@ static void decrypt_done(struct crypto_a if (rctx->left) return; +out: skcipher_request_complete(req, err); }