From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DFEB4C48BF6 for ; Mon, 26 Feb 2024 22:07:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=y/3tBmPEhkvKSB4uqMpcvbn3dneobydr4bEXKg7RNJM=; b=NOupA/0dYn83Wx VKXnuBnRDkrUN/TST8VLLf55l/7ZCGobdmsIkDrQRVSFf7y2j0Q3RAuZsULST0GLoocRcJ0FQoLa+ VoDZw4vNwis4IA/padgSO5r9gLgF+grGSeO/GzVqmoLkISxfzb1/H3xQMtvddyHM21MEAdlYb6b8w S+Dmoci7kDml8roXSrDSGDULLqgD8scTFA5qW/b9QEkrXWCaXtuHlxfhjXPHCG341Sma1QuIO9N15 W4L2KhKGSWMKw1q7+7q/E29CmhxUhEqc9xSDrOILH407E3WXDzSdC+k8IGKhL0F+nxOwpcXep3jAn oexlozjvnUfJqN9joK2w==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rej8Z-00000002nTf-2SnM; Mon, 26 Feb 2024 22:07:51 +0000 Received: from mail-lf1-x12d.google.com ([2a00:1450:4864:20::12d]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rej8U-00000002nSq-3xk4 for linux-arm-kernel@lists.infradead.org; Mon, 26 Feb 2024 22:07:49 +0000 Received: by mail-lf1-x12d.google.com with SMTP id 2adb3069b0e04-512fcef91d4so1983487e87.3 for ; Mon, 26 Feb 2024 14:07:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1708985265; x=1709590065; darn=lists.infradead.org; h=in-reply-to:content-disposition:mime-version:references :mail-followup-to:message-id:subject:cc:to:from:date:from:to:cc :subject:date:message-id:reply-to; bh=pHEg/PobD24tdsAcn0OzUyhowswPKvxcAqmhC1J0GNY=; b=KF8kL3vWrsNmCeprRqPSE+Y8psQoDvynWB/onwxKrtAx87f5Qi1YH2/DBKzpAnpEUu axL6lFW3SPSiXN03YlXqA3szz5tW6y7cVSilrd1F3mCtEJsEl06ek1EWSNCcSy6eS4vw LxdCAvUo9nqRaDr4f0qLdGcZXcBQXESWeOSgIPmlUsFZoR/IE8AWTQkwhPiW1AivxVpx w+FBYKMjpXYhbGeoYP2fEZg7ktyKEUvRZaILWFn2LoxTl/rCnQePmmX1HmTws9wqEN3k tgyOBI9AOAS3J3iK36LpaA6Ky33CJPbOPr+H3KQHWrlYpp5wQ23jrJMvCGUgYeMxAk2o mHkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1708985265; x=1709590065; h=in-reply-to:content-disposition:mime-version:references :mail-followup-to:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=pHEg/PobD24tdsAcn0OzUyhowswPKvxcAqmhC1J0GNY=; b=mPinMATui4sfshFmE04I6v1OlKBBSBG+rabDYPmqvzd7eQGBWMfs85Qi49NJu477mi 7D920ZbA+xKngBjE3xnIlfQUf5FrBMYuMCWypawPyzqC4T+2dyIp0bj2boNMSkCwkcDy tiFyj5kjQPZhLCe96LVSZZug1VuiQJC6dV4xyegTD/7QEQWdgKo8mNF+TbFtIy2F6Lxw Qm4l0E3x2hNaVDvgRX8LvaN49svGAzsRQd/bXkxip3b745+7BJ1dMY5pH616un8DvLtn w1ZiRvxnoNwUETtDTDXtWLypjfwUIQf5W6ZhisheZkWaeLQQzeWoFqGLGAW9OUByh++7 qI3w== X-Forwarded-Encrypted: i=1; AJvYcCUa63lLSdKuB1hpeM94oo2vljeFMMDt0Rb9Zo+dIjUUsv6VhQug66xzUj78n/wRLpV5eCsgEb5Tyah0nUuRY6nppuWsTAAogBSBBRSA+qIuWWH3zAQ= X-Gm-Message-State: AOJu0YzIEXcYNfG9KXBcyed26T/6w25BH0av1apxQ6KxUb25fcRMA+mr Q/WVsj4S2sXCZu4PwyrDOzWrJaGs3n1Gh04ptqCd+Lj9XVm6Uhd8 X-Google-Smtp-Source: AGHT+IGz0v9kfZ8Pryt+LljBAadvtBLU3DXwhJnm4Yo8WhLtfZT8YFLtxKyvtv7wmiR80zXDE5VPcw== X-Received: by 2002:a05:6512:b0f:b0:512:b71d:3283 with SMTP id w15-20020a0565120b0f00b00512b71d3283mr6197335lfu.67.1708985264849; Mon, 26 Feb 2024 14:07:44 -0800 (PST) Received: from localhost ([94.19.228.143]) by smtp.gmail.com with ESMTPSA id w4-20020a19c504000000b00512fe237508sm446024lfe.27.2024.02.26.14.07.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 Feb 2024 14:07:44 -0800 (PST) Date: Tue, 27 Feb 2024 01:05:30 +0300 From: Andrey Skvortsov To: Corentin Labbe , Herbert Xu , "David S. Miller" , Chen-Yu Tsai , Jernej Skrabec , Samuel Holland , Jonathan Corbet , Ovidiu Panait , linux-crypto@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org Cc: Arnaud Ferraris Subject: Re: [PATCH] crypto: sun8i-ce - Fix use after free in unprepare. Message-ID: Mail-Followup-To: Andrey Skvortsov , Corentin Labbe , Herbert Xu , "David S. Miller" , Chen-Yu Tsai , Jernej Skrabec , Samuel Holland , Jonathan Corbet , Ovidiu Panait , linux-crypto@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, Arnaud Ferraris References: <20240226215358.555234-1-andrej.skvortzov@gmail.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20240226215358.555234-1-andrej.skvortzov@gmail.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240226_140748_417039_60224C60 X-CRM114-Status: GOOD ( 16.31 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 24-02-27 00:53, Andrey Skvortsov wrote: > sun8i_ce_cipher_unprepare should be called before > crypto_finalize_skcipher_request, because client callbacks may > immediately free memory, that isn't needed anymore. But it will be > used by unprepare after free. Before removing prepare/unprepare > callbacks it was handled by crypto engine in crypto_finalize_request. And potentially rk3288_crypto driver is affected by the similar problem. https://elixir.bootlin.com/linux/v6.8-rc6/source/drivers/crypto/rockchip/rk3288_crypto_ahash.c#L339 > > Usually that results in a pointer dereference problem during a in > crypto selftest. > Unable to handle kernel NULL pointer dereference at > virtual address 0000000000000030 > Mem abort info: > ESR = 0x0000000096000004 > EC = 0x25: DABT (current EL), IL = 32 bits > SET = 0, FnV = 0 > EA = 0, S1PTW = 0 > FSC = 0x04: level 0 translation fault > Data abort info: > ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 > CM = 0, WnR = 0, TnD = 0, TagAccess = 0 > GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 > user pgtable: 4k pages, 48-bit VAs, pgdp=000000004716d000 > [0000000000000030] pgd=0000000000000000, p4d=0000000000000000 > Internal error: Oops: 0000000096000004 [#1] SMP > > This problem is detected by KASAN as well. > ================================================================== > BUG: KASAN: slab-use-after-free in sun8i_ce_cipher_do_one+0x6e8/0xf80 [sun8i_ce] > Read of size 8 at addr ffff00000dcdc040 by task 1c15000.crypto-/373 > > Hardware name: Pine64 PinePhone (1.2) (DT) > Call trace: > dump_backtrace+0x9c/0x128 > show_stack+0x20/0x38 > dump_stack_lvl+0x48/0x60 > print_report+0xf8/0x5d8 > kasan_report+0x90/0xd0 > __asan_load8+0x9c/0xc0 > sun8i_ce_cipher_do_one+0x6e8/0xf80 [sun8i_ce] > crypto_pump_work+0x354/0x620 [crypto_engine] > kthread_worker_fn+0x244/0x498 > kthread+0x168/0x178 > ret_from_fork+0x10/0x20 > > Allocated by task 379: > kasan_save_stack+0x3c/0x68 > kasan_set_track+0x2c/0x40 > kasan_save_alloc_info+0x24/0x38 > __kasan_kmalloc+0xd4/0xd8 > __kmalloc+0x74/0x1d0 > alg_test_skcipher+0x90/0x1f0 > alg_test+0x24c/0x830 > cryptomgr_test+0x38/0x60 > kthread+0x168/0x178 > ret_from_fork+0x10/0x20 > > Freed by task 379: > kasan_save_stack+0x3c/0x68 > kasan_set_track+0x2c/0x40 > kasan_save_free_info+0x38/0x60 > __kasan_slab_free+0x100/0x170 > slab_free_freelist_hook+0xd4/0x1e8 > __kmem_cache_free+0x15c/0x290 > kfree+0x74/0x100 > kfree_sensitive+0x80/0xb0 > alg_test_skcipher+0x12c/0x1f0 > alg_test+0x24c/0x830 > cryptomgr_test+0x38/0x60 > kthread+0x168/0x178 > ret_from_fork+0x10/0x20 > > The buggy address belongs to the object at ffff00000dcdc000 > which belongs to the cache kmalloc-256 of size 256 > The buggy address is located 64 bytes inside of > freed 256-byte region [ffff00000dcdc000, ffff00000dcdc100) > > Signed-off-by: Andrey Skvortsov > Fixes: 4136212ab18e ("crypto: sun8i-ce - Remove prepare/unprepare request") -- Best regards, Andrey Skvortsov _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel