From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F13DC04E87 for ; Fri, 17 May 2019 12:39:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E430521734 for ; Fri, 17 May 2019 12:39:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1558096776; bh=Cfln2fx3fqXP1bcsm+QMQ5UtcbqxFf279mfl0cNjfUQ=; h=Subject:To:Cc:From:Date:List-ID:From; b=11I7i+mUSwNeTRYLVJiixpld/RPzQJ5dOk4+Q1J/oY0a/MjcWU2UlLb2RAbtAWztU F3mMlbapKRG5tlBGyZlu2Gqz52ddv56x85a3EiJe+coMuoxTS4UDkZEhsarjtsc/Mx rvP47zqh3B87LJaAuu0C2pzlo7Y97pRc6IYBLPOQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728955AbfEQMjf (ORCPT ); Fri, 17 May 2019 08:39:35 -0400 Received: from wout3-smtp.messagingengine.com ([64.147.123.19]:60313 "EHLO wout3-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728169AbfEQMje (ORCPT ); Fri, 17 May 2019 08:39:34 -0400 Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.west.internal (Postfix) with ESMTP id 7228D31F; Fri, 17 May 2019 08:39:33 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute6.internal (MEProxy); Fri, 17 May 2019 08:39:33 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:message-id:mime-version:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=bkgbiG YpNGLbd0a0OIsZ7YLrYHD+ClO+4o0APQf1CPM=; b=ITHt78KlBV1q4Awnj6yzpI qGtVZteQ3KYhLeOZpN6Gpv/9ObemlAa6Ux5JSSY27f/9XcAME7r6xzEPmydwjJHo U8TwzvU4NeGmwm6QRWX3S4A5Nsyrt/3TxrBfuQ2UYYZIDYlOPpCKbquOHqOobcFh qITvlkBxzS6NomK9pyYC0nm1Wm92vSYPFs3udM0ueVTvgd4A8QZ5GkJ033jJEpQ0 dNJjr4GXn0MLXDgg81EL+uGzaH1IQCmG/yYzHawsz/YSoL8ER2o7xf+mBkJqufXL Xi0himiEMbvUV/LcMi+S+uF3gZ65IyoTBsJ+M7hHr/aY1C4WY7roOIm2U2J74KAg == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduuddruddtvddgheehucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefuvffhfffkgggtgfesthekredttd dtlfenucfhrhhomhepoehgrhgvghhkhheslhhinhhugihfohhunhgurghtihhonhdrohhr gheqnecukfhppeekfedrkeeirdekledruddtjeenucfrrghrrghmpehmrghilhhfrhhomh epghhrvghgsehkrhhorghhrdgtohhmnecuvehluhhsthgvrhfuihiivgepfe X-ME-Proxy: Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) by mail.messagingengine.com (Postfix) with ESMTPA id D4E8280061; Fri, 17 May 2019 08:39:31 -0400 (EDT) Subject: FAILED: patch "[PATCH] crypto: arm/aes-neonbs - don't access already-freed walk.iv" failed to apply to 4.9-stable tree To: ebiggers@google.com, herbert@gondor.apana.org.au, stable@vger.kernel.org Cc: From: Date: Fri, 17 May 2019 14:39:29 +0200 Message-ID: <155809676936131@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 767f015ea0b7ab9d60432ff6cd06b664fd71f50f Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Tue, 9 Apr 2019 23:46:31 -0700 Subject: [PATCH] crypto: arm/aes-neonbs - don't access already-freed walk.iv If the user-provided IV needs to be aligned to the algorithm's alignmask, then skcipher_walk_virt() copies the IV into a new aligned buffer walk.iv. But skcipher_walk_virt() can fail afterwards, and then if the caller unconditionally accesses walk.iv, it's a use-after-free. arm32 xts-aes-neonbs doesn't set an alignmask, so currently it isn't affected by this despite unconditionally accessing walk.iv. However this is more subtle than desired, and it was actually broken prior to the alignmask being removed by commit cc477bf64573 ("crypto: arm/aes - replace bit-sliced OpenSSL NEON code"). Thus, update xts-aes-neonbs to start checking the return value of skcipher_walk_virt(). Fixes: e4e7f10bfc40 ("ARM: add support for bit sliced AES using NEON instructions") Cc: # v3.13+ Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu diff --git a/arch/arm/crypto/aes-neonbs-glue.c b/arch/arm/crypto/aes-neonbs-glue.c index 07e31941dc67..617c2c99ebfb 100644 --- a/arch/arm/crypto/aes-neonbs-glue.c +++ b/arch/arm/crypto/aes-neonbs-glue.c @@ -278,6 +278,8 @@ static int __xts_crypt(struct skcipher_request *req, int err; err = skcipher_walk_virt(&walk, req, true); + if (err) + return err; crypto_cipher_encrypt_one(ctx->tweak_tfm, walk.iv, walk.iv);