* [PATCH] crypto: essiv: avoid request access after subrequest
@ 2026-09-21 9:04 Jiale Yao
2026-09-21 9:09 ` jiale yao
2026-09-21 13:07 ` [PATCH] " Ard Biesheuvel
0 siblings, 2 replies; 3+ messages in thread
From: Jiale Yao @ 2026-09-21 9:04 UTC (permalink / raw)
To: Herbert Xu, David S. Miller, Mike Snitzer, Ard Biesheuvel,
linux-crypto, linux-kernel
Cc: Jiale Yao
essiv_aead_crypt() reads rctx->assoc after submitting the child AEAD
request. An asynchronous completion can run essiv_aead_done(), free the
association buffer, and complete the outer request before the submission
call returns. The later request-context access can therefore use freed
memory and trigger a second free.
Snapshot the association buffer pointer before submitting the child
request and use the local value for synchronous cleanup.
Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
crypto/essiv.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/crypto/essiv.c b/crypto/essiv.c
index a47a3eab6935..5aea4584d5cb 100644
--- a/crypto/essiv.c
+++ b/crypto/essiv.c
@@ -189,6 +189,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
int ivsize = crypto_aead_ivsize(tfm);
int ssize = req->assoclen - ivsize;
struct scatterlist *src = req->src;
+ void *assoc;
int err;
if (ssize < 0)
@@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
essiv_aead_done, req);
aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv);
+ assoc = rctx->assoc;
err = enc ? crypto_aead_encrypt(subreq) :
crypto_aead_decrypt(subreq);
- if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
- kfree(rctx->assoc);
+ if (assoc && err != -EINPROGRESS && err != -EBUSY)
+ kfree(assoc);
return err;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re:[PATCH] crypto: essiv: avoid request access after subrequest
2026-09-21 9:04 [PATCH] crypto: essiv: avoid request access after subrequest Jiale Yao
@ 2026-09-21 9:09 ` jiale yao
2026-09-21 13:07 ` [PATCH] " Ard Biesheuvel
1 sibling, 0 replies; 3+ messages in thread
From: jiale yao @ 2026-09-21 9:09 UTC (permalink / raw)
To: Herbert Xu, David S. Miller, Mike Snitzer, Ard Biesheuvel,
linux-crypto, linux-kernel
The KASAN is below:
[ 31.903236] BUG: KASAN: double-free in essiv_aead_crypt+0x7d3/0xa90
[ 31.903799] Free of addr ffff888105ecc000 by task poc/90
[ 31.904262]
[1] sendmsg(as[ 31.904414] CPU: 3 UID: 0 PID: 90 Comm: poc Not tainted 6.18.52 #5 PREEMPT(voluntary)
soclen=8208 ssiz[ 31.904418] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 31.904419] Call Trace:
[ 31.904422] <TASK>
[ 31.904423] dump_stack_lvl+0x48/0x120
[ 31.904440] print_report+0x191/0x580
[ 31.904452] ? essiv_aead_crypt+0x7d3/0xa90
[ 31.904454] kasan_report_invalid_free+0x103/0x130
[ 31.904456] ? essiv_aead_crypt+0x7d3/0xa90
[ 31.904457] ? essiv_aead_crypt+0x7d3/0xa90
e=8192 cryptlen=[ 31.904458] check_slab_allocation+0x102/0x150
[ 31.904460] kfree+0xae/0x410
[ 31.904461] ? essiv_aead_crypt+0x7d3/0xa90
[ 31.904463] essiv_aead_crypt+0x7d3/0xa90
[ 31.904464] aead_recvmsg+0xaaa/0xe80
64) -> 8272 (que[ 31.904467] ? __pfx_aead_recvmsg+0x10/0x10
[ 31.904469] sock_recvmsg+0x139/0x180
[ 31.904480] ____sys_recvmsg+0x15d/0x360
[ 31.904482] ___sys_recvmsg+0x165/0x630
[ 31.904484] __x64_sys_recvmsg+0x121/0x180
[ 31.904486] do_syscall_64+0xcf/0x2e0
ued)
[ 31.904489] ? fpregs_assert_state_consistent+0x4b/0xf0
[ 31.904491] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 31.904493] RIP: 0033:0x453a7d
[ 31.904495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 41 54 48 83 ec 10 64 8b 04 25 18 00 00 00 85 c0 75 22 b8 2f 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5b 4c 63 e0 48 83 c4 10 4c 89 e0 41 5c c3 66
[ 31.904496] RSP: 002b:00007ffcb84371c0 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
[ 31.904499] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000453a7d
[ 31.904500] RDX: 0000000000000040 RSI: 00007ffcb84371f0 RDI: 0000000000000004
[ 31.904501] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[ 31.904502] R10: 000000000049a19f R11: 0000000000000246 R12: 0000000001a8a7e0
[ 31.904502] R13: 0000000001a88780 R14: 00007ffcb84371f0 R15: 0000000000000004
[ 31.904504] </TASK>
[ 31.904504]
[ 31.919640] Allocated by task 90:
[ 31.919941] kasan_save_track+0x3f/0x80
[ 31.920276] __kasan_kmalloc+0x82/0x90
[ 31.920596] __kmalloc_noprof+0x26d/0x550
[ 31.920940] essiv_aead_crypt+0x7f6/0xa90
[ 31.921290] aead_recvmsg+0xaaa/0xe80
[ 31.921620] sock_recvmsg+0x139/0x180
[ 31.921936] ____sys_recvmsg+0x15d/0x360
[ 31.922269] ___sys_recvmsg+0x165/0x630
[ 31.922595] __x64_sys_recvmsg+0x121/0x180
[ 31.922940] do_syscall_64+0xcf/0x2e0
[ 31.923251] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 31.923707]
[ 31.923851] Freed by task 90:
[ 31.924145] kasan_save_track+0x3f/0x80
[ 31.924470] __kasan_save_free_info+0x40/0x50
[ 31.924838] __kasan_slab_free+0x3a/0x60
[ 31.925173] kfree+0x100/0x410
[ 31.925471] essiv_aead_done+0x45/0x90
[ 31.925791] crypto_authenc_encrypt+0x5d5/0x830
[ 31.926176] essiv_aead_crypt+0x799/0xa90
[ 31.926512] aead_recvmsg+0xaaa/0xe80
[ 31.926828] sock_recvmsg+0x139/0x180
[ 31.927144] ____sys_recvmsg+0x15d/0x360
[ 31.927520] ___sys_recvmsg+0x165/0x630
[ 31.927870] __x64_sys_recvmsg+0x121/0x180
[ 31.928236] do_syscall_64+0xcf/0x2e0
[ 31.928565] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 31.929018]
[ 31.929188] The buggy address belongs to the object at ffff888105ecc000
[ 31.929188] which belongs to the cache kmalloc-8k of size 8192
[ 31.930195] The buggy address is located 0 bytes inside of
[ 31.930195] 8192-byte region [ffff888105ecc000, ffff888105ece000)
At 2026-09-21 17:04:57, "Jiale Yao" <yaojiale02@163.com> wrote:
>essiv_aead_crypt() reads rctx->assoc after submitting the child AEAD
>request. An asynchronous completion can run essiv_aead_done(), free the
>association buffer, and complete the outer request before the submission
>call returns. The later request-context access can therefore use freed
>memory and trigger a second free.
>
>Snapshot the association buffer pointer before submitting the child
>request and use the local value for synchronous cleanup.
>
>Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
>
>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> crypto/essiv.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
>diff --git a/crypto/essiv.c b/crypto/essiv.c
>index a47a3eab6935..5aea4584d5cb 100644
>--- a/crypto/essiv.c
>+++ b/crypto/essiv.c
>@@ -189,6 +189,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
> int ivsize = crypto_aead_ivsize(tfm);
> int ssize = req->assoclen - ivsize;
> struct scatterlist *src = req->src;
>+ void *assoc;
> int err;
>
> if (ssize < 0)
>@@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
> essiv_aead_done, req);
> aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv);
>
>+ assoc = rctx->assoc;
> err = enc ? crypto_aead_encrypt(subreq) :
> crypto_aead_decrypt(subreq);
>
>- if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
>- kfree(rctx->assoc);
>+ if (assoc && err != -EINPROGRESS && err != -EBUSY)
>+ kfree(assoc);
> return err;
> }
>
>--
>2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] crypto: essiv: avoid request access after subrequest
2026-09-21 9:04 [PATCH] crypto: essiv: avoid request access after subrequest Jiale Yao
2026-09-21 9:09 ` jiale yao
@ 2026-09-21 13:07 ` Ard Biesheuvel
1 sibling, 0 replies; 3+ messages in thread
From: Ard Biesheuvel @ 2026-09-21 13:07 UTC (permalink / raw)
To: Jiale Yao, Herbert Xu, David S. Miller, Mike Snitzer,
linux-crypto, linux-kernel
On Mon, 21 Sep 2026, at 11:04, Jiale Yao wrote:
> essiv_aead_crypt() reads rctx->assoc after submitting the child AEAD
> request. An asynchronous completion can run essiv_aead_done(), free the
> association buffer, and complete the outer request before the submission
> call returns. The later request-context access can therefore use freed
> memory and trigger a second free.
>
> Snapshot the association buffer pointer before submitting the child
> request and use the local value for synchronous cleanup.
>
> Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV
> generation")
>
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
> crypto/essiv.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/crypto/essiv.c b/crypto/essiv.c
> index a47a3eab6935..5aea4584d5cb 100644
> --- a/crypto/essiv.c
> +++ b/crypto/essiv.c
> @@ -189,6 +189,7 @@ static int essiv_aead_crypt(struct aead_request
> *req, bool enc)
> int ivsize = crypto_aead_ivsize(tfm);
> int ssize = req->assoclen - ivsize;
> struct scatterlist *src = req->src;
> + void *assoc;
> int err;
>
> if (ssize < 0)
> @@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request
> *req, bool enc)
> essiv_aead_done, req);
> aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv);
>
> + assoc = rctx->assoc;
> err = enc ? crypto_aead_encrypt(subreq) :
> crypto_aead_decrypt(subreq);
>
> - if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
> - kfree(rctx->assoc);
> + if (assoc && err != -EINPROGRESS && err != -EBUSY)
> + kfree(assoc);
> return err;
> }
>
The problem here seems to be that rctx is dereferenced before the comparison
of err. Just drop it completely from the if: kfree() ignores NULL pointers
anyway.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-21 13:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-21 9:04 [PATCH] crypto: essiv: avoid request access after subrequest Jiale Yao
2026-09-21 9:09 ` jiale yao
2026-09-21 13:07 ` [PATCH] " Ard Biesheuvel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox