From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Mathias Krause <minipli@googlemail.com>,
Steffen Klassert <steffen.klassert@secunet.com>,
PaX Team <pageexec@freemail.hu>,
Herbert Xu <herbert@gondor.apana.org.au>
Subject: [PATCH 3.10 62/64] crypto: user - lock crypto_alg_list on alg dump
Date: Sun, 14 Feb 2016 14:23:34 -0800 [thread overview]
Message-ID: <20160214222223.296465521@linuxfoundation.org> (raw)
In-Reply-To: <20160214222221.031471863@linuxfoundation.org>
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <minipli@googlemail.com>
commit 63e41ebc6630f39422d87f8a4bade1e793f37a01 upstream.
We miss to take the crypto_alg_sem semaphore when traversing the
crypto_alg_list for CRYPTO_MSG_GETALG dumps. This allows a race with
crypto_unregister_alg() removing algorithms from the list while we're
still traversing it, thereby leading to a use-after-free as show below:
[ 3482.071639] general protection fault: 0000 [#1] SMP
[ 3482.075639] Modules linked in: aes_x86_64 glue_helper lrw ablk_helper cryptd gf128mul ipv6 pcspkr serio_raw virtio_net microcode virtio_pci virtio_ring virtio sr_mod cdrom [last unloaded: aesni_intel]
[ 3482.075639] CPU: 1 PID: 11065 Comm: crconf Not tainted 4.3.4-grsec+ #126
[ 3482.075639] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 3482.075639] task: ffff88001cd41a40 ti: ffff88001cd422c8 task.ti: ffff88001cd422c8
[ 3482.075639] RIP: 0010:[<ffffffff93722bd3>] [<ffffffff93722bd3>] strncpy+0x13/0x30
[ 3482.075639] RSP: 0018:ffff88001f713b60 EFLAGS: 00010202
[ 3482.075639] RAX: ffff88001f6c4430 RBX: ffff88001f6c43a0 RCX: ffff88001f6c4430
[ 3482.075639] RDX: 0000000000000040 RSI: fefefefefefeff16 RDI: ffff88001f6c4430
[ 3482.075639] RBP: ffff88001f713b60 R08: ffff88001f6c4470 R09: ffff88001f6c4480
[ 3482.075639] R10: 0000000000000002 R11: 0000000000000246 R12: ffff88001ce2aa28
[ 3482.075639] R13: ffff880000093700 R14: ffff88001f5e4bf8 R15: 0000000000003b20
[ 3482.075639] FS: 0000033826fa2700(0000) GS:ffff88001e900000(0000) knlGS:0000000000000000
[ 3482.075639] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3482.075639] CR2: ffffffffff600400 CR3: 00000000139ec000 CR4: 00000000001606f0
[ 3482.075639] Stack:
[ 3482.075639] ffff88001f713bd8 ffffffff936ccd00 ffff88001e5c4200 ffff880000093700
[ 3482.075639] ffff88001f713bd0 ffffffff938ef4bf 0000000000000000 0000000000003b20
[ 3482.075639] ffff88001f5e4bf8 ffff88001f5e4848 0000000000000000 0000000000003b20
[ 3482.075639] Call Trace:
[ 3482.075639] [<ffffffff936ccd00>] crypto_report_alg+0xc0/0x3e0
[ 3482.075639] [<ffffffff938ef4bf>] ? __alloc_skb+0x16f/0x300
[ 3482.075639] [<ffffffff936cd08a>] crypto_dump_report+0x6a/0x90
[ 3482.075639] [<ffffffff93935707>] netlink_dump+0x147/0x2e0
[ 3482.075639] [<ffffffff93935f99>] __netlink_dump_start+0x159/0x190
[ 3482.075639] [<ffffffff936ccb13>] crypto_user_rcv_msg+0xc3/0x130
[ 3482.075639] [<ffffffff936cd020>] ? crypto_report_alg+0x3e0/0x3e0
[ 3482.075639] [<ffffffff936cc4b0>] ? alg_test_crc32c+0x120/0x120
[ 3482.075639] [<ffffffff93933145>] ? __netlink_lookup+0xd5/0x120
[ 3482.075639] [<ffffffff936cca50>] ? crypto_add_alg+0x1d0/0x1d0
[ 3482.075639] [<ffffffff93938141>] netlink_rcv_skb+0xe1/0x130
[ 3482.075639] [<ffffffff936cc4f8>] crypto_netlink_rcv+0x28/0x40
[ 3482.075639] [<ffffffff939375a8>] netlink_unicast+0x108/0x180
[ 3482.075639] [<ffffffff93937c21>] netlink_sendmsg+0x541/0x770
[ 3482.075639] [<ffffffff938e31e1>] sock_sendmsg+0x21/0x40
[ 3482.075639] [<ffffffff938e4763>] SyS_sendto+0xf3/0x130
[ 3482.075639] [<ffffffff93444203>] ? bad_area_nosemaphore+0x13/0x20
[ 3482.075639] [<ffffffff93444470>] ? __do_page_fault+0x80/0x3a0
[ 3482.075639] [<ffffffff939d80cb>] entry_SYSCALL_64_fastpath+0x12/0x6e
[ 3482.075639] Code: 88 4a ff 75 ed 5d 48 0f ba 2c 24 3f c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 85 d2 48 89 f8 48 89 f9 4c 8d 04 17 48 89 e5 74 15 <0f> b6 16 80 fa 01 88 11 48 83 de ff 48 83 c1 01 4c 39 c1 75 eb
[ 3482.075639] RIP [<ffffffff93722bd3>] strncpy+0x13/0x30
To trigger the race run the following loops simultaneously for a while:
$ while : ; do modprobe aesni-intel; rmmod aesni-intel; done
$ while : ; do crconf show all > /dev/null; done
Fix the race by taking the crypto_alg_sem read lock, thereby preventing
crypto_unregister_alg() from modifying the algorithm list during the
dump.
This bug has been detected by the PaX memory sanitize feature.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: PaX Team <pageexec@freemail.hu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/crypto_user.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -477,6 +477,7 @@ static int crypto_user_rcv_msg(struct sk
if (link->dump == NULL)
return -EINVAL;
+ down_read(&crypto_alg_sem);
list_for_each_entry(alg, &crypto_alg_list, cra_list)
dump_alloc += CRYPTO_REPORT_MAXSIZE;
@@ -486,8 +487,11 @@ static int crypto_user_rcv_msg(struct sk
.done = link->done,
.min_dump_alloc = dump_alloc,
};
- return netlink_dump_start(crypto_nlsk, skb, nlh, &c);
+ err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
}
+ up_read(&crypto_alg_sem);
+
+ return err;
}
err = nlmsg_parse(nlh, crypto_msg_min[type], attrs, CRYPTOCFGA_MAX,
next prev parent reply other threads:[~2016-02-14 22:59 UTC|newest]
Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-14 22:22 [PATCH 3.10 00/64] 3.10.97-stable review Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 01/64] recordmcount: Fix endianness handling bug for nop_mcount Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 02/64] xhci: fix placement of call to usb_disabled() Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 03/64] crypto: algif_hash - Only export and import on sockets with data Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 04/64] dm btree: fix leak of bufio-backed block in btree_split_sibling error path Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 05/64] HID: usbhid: fix recursive deadlock Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 06/64] remoteproc: avoid stack overflow in debugfs file Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 07/64] kernel/signal.c: unexport sigsuspend() Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 08/64] ocfs2/dlm: ignore cleaning the migration mle that is inuse Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 09/64] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 10/64] sh64: fix __NR_fgetxattr Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 11/64] Revert "dm mpath: fix stalls when handling invalid ioctls" Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 12/64] spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 13/64] spi: fix parent-device reference leak Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 14/64] wlcore/wl12xx: spi: fix oops on firmware load Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 15/64] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 16/64] vTPM: fix memory allocation flag for rtce buffer at kernel boot Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 17/64] mtd: mtdpart: fix add_mtd_partitions error path Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 18/64] jbd2: Fix unreclaimed pages after truncate in data=journal mode Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 19/64] [PATCH] fix calculation of meta_bg descriptor backups Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 20/64] parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 21/64] parisc: Fix syscall restarts Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 22/64] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 23/64] [media] v4l2-compat-ioctl32: fix alignment for ARM64 Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 24/64] [media] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 25/64] fix sysvfs symlinks Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 26/64] ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 27/64] ALSA: usb-audio: avoid freeing umidi object twice Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 28/64] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 29/64] ALSA: dummy: Disable switching timer backend via sysfs Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 30/64] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 31/64] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 32/64] ALSA: rawmidi: Fix race at copying & updating the position Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 33/64] ALSA: pcm: Fix potential deadlock in OSS emulation Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 34/64] ASoC: dpcm: fix the BE state on hw_free Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 35/64] ALSA: seq: Fix yet another races among ALSA timer accesses Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 36/64] ALSA: seq: Fix race at closing in virmidi driver Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 37/64] ALSA: seq: Fix lockdep warnings due to double mutex locks Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 38/64] ALSA: timer: Code cleanup Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 39/64] ALSA: timer: Fix leftover link at closing Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 40/64] ALSA: timer: Fix link corruption due to double start or stop Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 41/64] ALSA: timer: Fix wrong instance passed to slave callbacks Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 42/64] ALSA: hda - Fix speaker output from VAIO AiO machines Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 43/64] ALSA: dummy: Implement timer backend switching more safely Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 44/64] ALSA: timer: Fix race between stop and interrupt Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 45/64] [media] saa7134-alsa: Only frees registered sound cards Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 46/64] USB: ti_usb_3410_502: Fix ID table size Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 47/64] USB: serial: visor: fix crash on detecting device without write_urbs Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 48/64] USB: visor: fix null-deref at probe Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 49/64] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 50/64] USB: cp210x: add ID for IAI USB to RS485 adaptor Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 51/64] USB: serial: option: Adding support for Telit LE922 Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 52/64] USB: option: fix Cinterion AHxx enumeration Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 53/64] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 54/64] ext4: Fix handling of extended tv_sec Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 55/64] crypto: af_alg - Disallow bind/setkey/... after accept(2) Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 56/64] crypto: af_alg - Fix socket double-free when accept fails Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 57/64] AHCI: Fix softreset failed issue of Port Multiplier Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 58/64] libata: disable forced PORTS_IMPL for >= AHCI 1.3 Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 59/64] ahci: Intel DNV device IDs SATA Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 60/64] crypto: algif_hash - wait for crypto_ahash_init() to complete Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 61/64] EVM: Use crypto_memneq() for digest comparisons Greg Kroah-Hartman
2016-02-14 22:23 ` Greg Kroah-Hartman [this message]
2016-02-14 22:23 ` [PATCH 3.10 63/64] FS-Cache: Increase reference of parent after registering, netfs success Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 64/64] binfmt_elf: Dont clobber passed executables file header Greg Kroah-Hartman
2016-02-15 5:20 ` [PATCH 3.10 00/64] 3.10.97-stable review Guenter Roeck
2016-02-15 18:12 ` Greg Kroah-Hartman
2016-02-15 15:46 ` Guenter Roeck
2016-02-15 17:13 ` Shuah Khan
2016-02-17 20:30 ` Greg Kroah-Hartman
2016-02-17 20:36 ` Shuah Khan
2016-02-17 23:26 ` Willy Tarreau
2016-02-17 23:33 ` Shuah Khan
2016-02-18 3:24 ` Shuah Khan
2016-02-19 22:22 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160214222223.296465521@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=herbert@gondor.apana.org.au \
--cc=linux-kernel@vger.kernel.org \
--cc=minipli@googlemail.com \
--cc=pageexec@freemail.hu \
--cc=stable@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).