From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9055DC04E87 for ; Fri, 17 May 2019 12:39:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 62C872087B for ; Fri, 17 May 2019 12:39:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1558096782; bh=eHsXKl/rhTdEACT1HGHQ4A0P1w8nIsFUnMdK9I6uF/I=; h=Subject:To:Cc:From:Date:List-ID:From; b=jhLcYOa8HlH6zbRNKk5LOipQ9zQHefvqZ/5/6Al1YF6Cf32ZisPcBTmAKLlXBh2Sc QZRNi8XHN7tyNnpRuyHFJ0gjFOnh+w5IcAKCq0ysruygwjCljwFIVqQ8XjlgEXriP0 UmP95qW1g6E9loop57Shy7QqBBlIvGXp7i9wZiKU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728958AbfEQMjm (ORCPT ); Fri, 17 May 2019 08:39:42 -0400 Received: from wout3-smtp.messagingengine.com ([64.147.123.19]:38291 "EHLO wout3-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728957AbfEQMjl (ORCPT ); Fri, 17 May 2019 08:39:41 -0400 Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.west.internal (Postfix) with ESMTP id C3F27319; Fri, 17 May 2019 08:39:40 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute6.internal (MEProxy); Fri, 17 May 2019 08:39:41 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:message-id:mime-version:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=bLKhmD 0tegxFqbCnevJeTl8p/003o/8yrZR8Q6vR1XM=; b=YT2HxZQ8t7RLGhH60JYXeP EbK/Lp7O/dAOrdownvSK4R4x2JOL8O8XxkpvYB5J0utDaVawBdHSXpMBQvTEP8Wl eqJd41kgo+DEwKX7/+45JK57Di6+inhnhPK/iaklZCrwEni8uDQ0E9Zc4vXOYSky yCusdqNyP8VbN81ocdZvjqQJH2LD0BKhK2GldNZXRVVLMi4Ok4kEFNw5qeE9YBTy HAheaoknFkkVoYBnNnJDXEu82YT3g5bw2Umqm+k0l+AB2Injcy1I/REeUpX2HH8z kr/PuPDGKquYOB85VyXhUAcwouPVmiIzHMHuh/hrz1KPwx/cdY/axzRP0hYfm5Yw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduuddruddtvddgheehucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefuvffhfffkgggtgfesthekredttd dtlfenucfhrhhomhepoehgrhgvghhkhheslhhinhhugihfohhunhgurghtihhonhdrohhr gheqnecukfhppeekfedrkeeirdekledruddtjeenucfrrghrrghmpehmrghilhhfrhhomh epghhrvghgsehkrhhorghhrdgtohhmnecuvehluhhsthgvrhfuihiivgepge X-ME-Proxy: Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) by mail.messagingengine.com (Postfix) with ESMTPA id CAD7D10379; Fri, 17 May 2019 08:39:39 -0400 (EDT) Subject: FAILED: patch "[PATCH] crypto: arm/aes-neonbs - don't access already-freed walk.iv" failed to apply to 4.4-stable tree To: ebiggers@google.com, herbert@gondor.apana.org.au, stable@vger.kernel.org Cc: From: Date: Fri, 17 May 2019 14:39:30 +0200 Message-ID: <15580967703179@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The patch below does not apply to the 4.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 767f015ea0b7ab9d60432ff6cd06b664fd71f50f Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Tue, 9 Apr 2019 23:46:31 -0700 Subject: [PATCH] crypto: arm/aes-neonbs - don't access already-freed walk.iv If the user-provided IV needs to be aligned to the algorithm's alignmask, then skcipher_walk_virt() copies the IV into a new aligned buffer walk.iv. But skcipher_walk_virt() can fail afterwards, and then if the caller unconditionally accesses walk.iv, it's a use-after-free. arm32 xts-aes-neonbs doesn't set an alignmask, so currently it isn't affected by this despite unconditionally accessing walk.iv. However this is more subtle than desired, and it was actually broken prior to the alignmask being removed by commit cc477bf64573 ("crypto: arm/aes - replace bit-sliced OpenSSL NEON code"). Thus, update xts-aes-neonbs to start checking the return value of skcipher_walk_virt(). Fixes: e4e7f10bfc40 ("ARM: add support for bit sliced AES using NEON instructions") Cc: # v3.13+ Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu diff --git a/arch/arm/crypto/aes-neonbs-glue.c b/arch/arm/crypto/aes-neonbs-glue.c index 07e31941dc67..617c2c99ebfb 100644 --- a/arch/arm/crypto/aes-neonbs-glue.c +++ b/arch/arm/crypto/aes-neonbs-glue.c @@ -278,6 +278,8 @@ static int __xts_crypt(struct skcipher_request *req, int err; err = skcipher_walk_virt(&walk, req, true); + if (err) + return err; crypto_cipher_encrypt_one(ctx->tweak_tfm, walk.iv, walk.iv);