[PATCH 6.6] crypto: starfive - Do not free stack buffer

[PATCH 6.6] crypto: starfive - Do not free stack buffer

[bin.lan.cn]

From: Jia Jie Ho <jiajie.ho@starfivetech.com>

[ Upstream commit d7f01649f4eaf1878472d3d3f480ae1e50d98f6c ]

RSA text data uses variable length buffer allocated in software stack.
Calling kfree on it causes undefined behaviour in subsequent operations.

Cc: <stable@vger.kernel.org> #6.7+
Signed-off-by: Jia Jie Ho <jiajie.ho@starfivetech.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
---
 drivers/crypto/starfive/jh7110-rsa.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/crypto/starfive/jh7110-rsa.c b/drivers/crypto/starfive/jh7110-rsa.c
index 1db9a3d02848..3116828d60a0 100644
--- a/drivers/crypto/starfive/jh7110-rsa.c
+++ b/drivers/crypto/starfive/jh7110-rsa.c
@@ -303,7 +303,6 @@ static int starfive_rsa_enc_core(struct starfive_cryp_ctx *ctx, int enc)
 
 err_rsa_crypt:
 	writel(STARFIVE_RSA_RESET, cryp->base + STARFIVE_PKA_CACR_OFFSET);
-	kfree(rctx->rsa_data);
 	return ret;
 }
 
-- 
2.34.1

Re: [PATCH 6.6] crypto: starfive - Do not free stack buffer

[Greg KH]

On Tue, Dec 03, 2024 at 02:52:13PM +0800, bin.lan.cn@eng.windriver.com wrote:
> From: Jia Jie Ho <jiajie.ho@starfivetech.com>
> 
> [ Upstream commit d7f01649f4eaf1878472d3d3f480ae1e50d98f6c ]
> 
> RSA text data uses variable length buffer allocated in software stack.
> Calling kfree on it causes undefined behaviour in subsequent operations.
> 
> Cc: <stable@vger.kernel.org> #6.7+

The cc: says 6.7 and newer, and yet you are wanting this for 6.6.y?
Why?  Why ignore what the author asked for?

thanks,

greg k-h

Re: [PATCH 6.6] crypto: starfive - Do not free stack buffer

[Bin Lan]

On 12/3/2024 4:23 PM, Greg KH wrote:
> CAUTION: This email comes from a non Wind River email account!
> Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
> On Tue, Dec 03, 2024 at 02:52:13PM +0800, bin.lan.cn@eng.windriver.com wrote:
>> From: Jia Jie Ho <jiajie.ho@starfivetech.com>
>>
>> [ Upstream commit d7f01649f4eaf1878472d3d3f480ae1e50d98f6c ]
>>
>> RSA text data uses variable length buffer allocated in software stack.
>> Calling kfree on it causes undefined behaviour in subsequent operations.
>>
>> Cc: <stable@vger.kernel.org> #6.7+
> The cc: says 6.7 and newer, and yet you are wanting this for 6.6.y?
> Why?  Why ignore what the author asked for?
>
> thanks,
>
> greg k-h

I want to backport it to fix CVE-2024-39478.

Bin Lan

Re: [PATCH 6.6] crypto: starfive - Do not free stack buffer

[Greg KH]

On Tue, Dec 03, 2024 at 04:34:25PM +0800, Bin Lan wrote:
> 
> On 12/3/2024 4:23 PM, Greg KH wrote:
> > CAUTION: This email comes from a non Wind River email account!
> > Do not click links or open attachments unless you recognize the sender and know the content is safe.
> > 
> > On Tue, Dec 03, 2024 at 02:52:13PM +0800, bin.lan.cn@eng.windriver.com wrote:
> > > From: Jia Jie Ho <jiajie.ho@starfivetech.com>
> > > 
> > > [ Upstream commit d7f01649f4eaf1878472d3d3f480ae1e50d98f6c ]
> > > 
> > > RSA text data uses variable length buffer allocated in software stack.
> > > Calling kfree on it causes undefined behaviour in subsequent operations.
> > > 
> > > Cc: <stable@vger.kernel.org> #6.7+
> > The cc: says 6.7 and newer, and yet you are wanting this for 6.6.y?
> > Why?  Why ignore what the author asked for?
> > 
> > thanks,
> > 
> > greg k-h
> 
> I want to backport it to fix CVE-2024-39478.

Again, how do you know that that CVE is relevant for kernels older than
6.7.y?  Have you tested this?  Have you proved that 6.6.y needs this?
If not, there's no way we can take it, nor would you want us to take it,
right?

thanks,

greg k-h

Re: [PATCH 6.6] crypto: starfive - Do not free stack buffer

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: d7f01649f4eaf1878472d3d3f480ae1e50d98f6c

WARNING: Author mismatch between patch and upstream commit:
Backport author: bin.lan.cn@eng.windriver.com
Commit author: Jia Jie Ho <jiajie.ho@starfivetech.com>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.11.y | Present (exact SHA1)
6.6.y | Not found

Note: The patch differs from the upstream commit:
---
1:  d7f01649f4eaf ! 1:  f914a30081e60 crypto: starfive - Do not free stack buffer
    @@ Metadata
      ## Commit message ##
         crypto: starfive - Do not free stack buffer
     
    +    [ Upstream commit d7f01649f4eaf1878472d3d3f480ae1e50d98f6c ]
    +
         RSA text data uses variable length buffer allocated in software stack.
         Calling kfree on it causes undefined behaviour in subsequent operations.
     
         Cc: <stable@vger.kernel.org> #6.7+
         Signed-off-by: Jia Jie Ho <jiajie.ho@starfivetech.com>
         Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    +    Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
     
      ## drivers/crypto/starfive/jh7110-rsa.c ##
     @@ drivers/crypto/starfive/jh7110-rsa.c: static int starfive_rsa_enc_core(struct starfive_cryp_ctx *ctx, int enc)
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.6.y        |  Success    |  Failed    |

Build Errors:
Build error for stable/linux-6.6.y: