From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794061116; b=N+V5/VLjNP+AHSxqx277P462i0rvTXt1bczluOeh2pzRFDrqAmVaeHtxvXVI4WO8dxLu x7BwQtyBF7wxiAx2aH8eHmMlu8rRi3KOc4tCEn3ihz5MhJgGAsKikAwj82WSRUa9hFc8e 5A04vE+ncJ9jxy3GlvU5h2M39pH0LAtLdlLZj1Ki4bU/dDFxSWBLPnvyQjNqOaUcjp9p7 rsIg2gt/TUEMYZXl+G8i4oQhzSpoq55KCsZ2AbpIlta3fFkn4TXyFW2hPoMysXFzMZny5 i3L9/GIZXmjZgPemqU4A2UDdNJEOZN8/MLBPnIJfvNw7CrkeE1h9OYBi2o8Sliq2E5Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794061116; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=atTsDcKIId/30734nZm812jVEmRqgBYrBlKSIRWKhxs=; b=HeGizr/GQ535Vl2L7PDjlcYtnp3RfeSi1Jp7iXt9oqhe70dio1Rre2qDZSSGc+CFoXAV B3mIYtRHpN+m6j80jk1A67uwfjSUec6RNnGzJSUShLHOOHCjWOn4eTrPeIfi+Oekg76ns bLZHz7PvduA3OyMG4QJ3/Cg6r4ButDGap03YuZFceh4TPbIXiQPVhNnh1AMOHqJvlsW7d 7D2Ifa1JgpjUAGQ307C0yt768Px1lHF41w6x/Ox3DmK5DnrXrRXdxD2X1q/eHR17zMgsS Qq466bqlJDoYyV7w2tPsFR1POla9AmlkrfoG5oCvCDboZvdMKevuR2x+ZA3lIUZSXFQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=keDmucUJ; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 10656606A332; Sat, 7 Nov 2026 14:18:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=keDmucUJ Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97E451F0089F; Sat, 7 Nov 2026 14:18:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794061115; bh=atTsDcKIId/30734nZm812jVEmRqgBYrBlKSIRWKhxs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=keDmucUJUIIS28tAjLwSWunpx5VhX/nFpQVVvYB7W5MiA6X1STe75g5l9orFTxe6M WMlt7XB5ujHVlU/QzqnbuZ4VEL14UMC1eE8eRUAtD44MGGs1eRXkYzdSmzD+SshIxn LTzM1t7h5VrhRqKsgt7hl5K6PdVNP25s78qWhaPI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sashiko , Eric Biggers , Baokun Li , Jens Axboe Subject: [PATCH 6.12 0431/1536] blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key() Date: Sat, 7 Nov 2026 08:40:47 -0500 Message-ID: <20261107135009.675162202@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134957.653319350@linuxfoundation.org> References: <20261107134957.653319350@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Baokun Li commit c8c53d669d4e45b3a804013251a34387d7e11bfb upstream. Sashiko reported a possible NULL pointer dereference, triggered by the following flow: dm-inlinecrypt ctor # first use of the fallback ├─ blk_crypto_init_key() # succeeds, ctx->key.size != 0 ├─ blk_crypto_start_using_key() │ ├─ hw-wrapped key: -EOPNOTSUPP │ │ # profile never allocated (NULL) │ └─ raw key: fallback_start_using_mode() │ └─ blk_crypto_fallback_init() fails │ └─ kfree(profile) # not NULLed ├─ goto bad └─ inlinecrypt_dtr() # evicts whenever key.size is set └─ blk_crypto_evict_key() └─ blk_crypto_config_supported_natively() = false └─ blk_crypto_fallback_evict_key() └─ __blk_crypto_evict_key(blk_crypto_fallback_profile) └─ profile->num_slots # BOOM!!! This issue can be reproduced using the following commands: dd if=/dev/zero of=/tmp/backing bs=1M count=64 LOOP=$(losetup -f --show /tmp/backing) SZ=$(blockdev --getsz $LOOP) KEY=$(head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n') dmsetup create ic --table "0 $SZ inlinecrypt aes-xts-plain64 \ $KEY 0 $LOOP 0 1 keytype:hw-wrapped" And the following oops is triggered: ================================================================== blk-crypto: loop0: no support for wrapped keys Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] CPU: 5 UID: 0 PID: 901 Comm: dmsetup 7.3.0-rc3 #1 PREEMPT(lazy) RIP: 0010:__blk_crypto_evict_key+0x2e/0x3b0 Call Trace: blk_crypto_evict_key+0x24c/0x320 inlinecrypt_dtr+0xf6/0x160 inlinecrypt_ctr+0x2d3/0xbd0 dm_table_add_target+0x661/0xf40 table_load+0x1c4/0x490 ctl_ioctl+0x32f/0x5f0 dm_ctl_ioctl+0xe/0x20 ================================================================== dm-inlinecrypt is the only caller that can evict a key that was never started, as fscrypt frees such a key without evicting it. Fix this by returning early from blk_crypto_fallback_evict_key() when tfms_inited[] is not set for the key's mode. tfms_inited[] is only set after blk_crypto_fallback_init() has successfully initialized the profile, so the crash above is no longer reachable. The bug has been latent since commit c984ff1423ae ("blk-crypto: dynamically allocate fallback profile") was merged in v6.5, and only became actually triggerable when commit e7f57d2c47e2 ("dm-inlinecrypt: add target for inline block device encryption") was merged in v7.2. Fixes: c984ff1423ae ("blk-crypto: dynamically allocate fallback profile") Cc: stable@vger.kernel.org Reported-by: Sashiko Closes: https://patch.msgid.link/sashiko-outbox-167341@kernel.org Suggested-by: Eric Biggers Link: https://patch.msgid.link/20261014155131.GB322435@quark Signed-off-by: Baokun Li Reviewed-by: Eric Biggers Link: https://patch.msgid.link/20261023081908.3505413-1-libaokun@linux.alibaba.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- block/blk-crypto-fallback.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/block/blk-crypto-fallback.c +++ b/block/blk-crypto-fallback.c @@ -530,6 +530,12 @@ bool blk_crypto_fallback_bio_prep(struct int blk_crypto_fallback_evict_key(const struct blk_crypto_key *key) { + /* + * Pairs with smp_store_release() in + * blk_crypto_fallback_start_using_mode() + */ + if (!smp_load_acquire(&tfms_inited[key->crypto_cfg.crypto_mode])) + return 0; return __blk_crypto_evict_key(blk_crypto_fallback_profile, key); }