linux-stable.git/crypto/af_alg.c, branch linux-3.16.y

crypto: af_alg - Use bh_lock_sock in sk_destruct

2020-05-22T20:19:15+00:00

commit 37f96694cf73ba116993a9d2d99ad6a75fa7fdb0 upstream.

As af_alg_release_parent may be called from BH context (most notably
due to an async request that only completes after socket closure,
or as reported here because of an RCU-delayed sk_destruct call), we
must use bh_lock_sock instead of lock_sock.

Reported-by: syzbot+c2f1558d49e25cc36e5e@syzkaller.appspotmail.com
Reported-by: Eric Dumazet 
Fixes: c840ac6af3f8 ("crypto: af_alg - Disallow bind/setkey/...")
Signed-off-by: Herbert Xu 
Signed-off-by: Ben Hutchings

crypto: af_alg - fix possible uninit-value in alg_bind()

2018-10-21T07:45:17+00:00

commit a466856e0b7ab269cdf9461886d007e88ff575b0 upstream.

syzbot reported :

BUG: KMSAN: uninit-value in alg_bind+0xe3/0xd90 crypto/af_alg.c:162

We need to check addr_len before dereferencing sa (or uaddr)

Fixes: bb30b8848c85 ("crypto: af_alg - whitelist mask and type")
Signed-off-by: Eric Dumazet 
Reported-by: syzbot 
Cc: Stephan Mueller 
Cc: Herbert Xu 
Signed-off-by: David S. Miller 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

crypto: af_alg - whitelist mask and type

2018-06-16T21:21:51+00:00

commit bb30b8848c85e18ca7e371d0a869e94b3e383bdf upstream.

The user space interface allows specifying the type and mask field used
to allocate the cipher. Only a subset of the possible flags are intended
for user space. Therefore, white-list the allowed flags.

In case the user space caller uses at least one non-allowed flag, EINVAL
is returned.

Reported-by: syzbot 
Signed-off-by: Stephan Mueller 
Signed-off-by: Herbert Xu 
[bwh: Backported to 3.16: We don't have a CRYPTO_ALG_INTENRAL flag and
 didn't blacklist it here]
Signed-off-by: Ben Hutchings

crypto: af_alg - Forbid bind(2) when nokey child sockets are present

2016-02-02T19:09:57+00:00

commit a6a48c565f6f112c6983e2a02b1602189ed6e26e upstream.

This patch forbids the calling of bind(2) when there are child
sockets created by accept(2) in existence, even if they are created
on the nokey path.

This is needed as those child sockets have references to the tfm
object which bind(2) will destroy.

Signed-off-by: Herbert Xu 
Signed-off-by: Luis Henriques

crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path

2016-02-02T19:09:56+00:00

commit 6a935170a980024dd29199e9dbb5c4da4767a1b9 upstream.

This patch allows af_alg_release_parent to be called even for
nokey sockets.

Signed-off-by: Herbert Xu 
Signed-off-by: Luis Henriques

crypto: af_alg - Add nokey compatibility path

2016-02-02T19:09:54+00:00

commit 37766586c965d63758ad542325a96d5384f4a8c9 upstream.

This patch adds a compatibility path to support old applications
that do acept(2) before setkey.

Signed-off-by: Herbert Xu 
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques

crypto: af_alg - Fix socket double-free when accept fails

2016-02-02T19:09:54+00:00

commit a383292c86663bbc31ac62cc0c04fc77504636a6 upstream.

When we fail an accept(2) call we will end up freeing the socket
twice, once due to the direct sk_free call and once again through
newsock.

This patch fixes this by removing the sk_free call.

Reported-by: Dmitry Vyukov 
Signed-off-by: Herbert Xu 
Signed-off-by: Luis Henriques

crypto: af_alg - Disallow bind/setkey/... after accept(2)

2016-02-02T19:09:53+00:00

commit c840ac6af3f8713a71b4d2363419145760bd6044 upstream.

Each af_alg parent socket obtained by socket(2) corresponds to a
tfm object once bind(2) has succeeded.  An accept(2) call on that
parent socket creates a context which then uses the tfm object.

Therefore as long as any child sockets created by accept(2) exist
the parent socket must not be modified or freed.

This patch guarantees this by using locks and a reference count
on the parent socket.  Any attempt to modify the parent socket will
fail with EBUSY.

Reported-by: Dmitry Vyukov 
Signed-off-by: Herbert Xu 
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques

crypto: af_alg - fix backlog handling

2015-01-15T10:44:51+00:00

commit 7e77bdebff5cb1e9876c561f69710b9ab8fa1f7e upstream.

If a request is backlogged, it's complete() handler will get called
twice: once with -EINPROGRESS, and once with the final error code.

af_alg's complete handler, unlike other users, does not handle the
-EINPROGRESS but instead always completes the completion that recvmsg()
is waiting on.  This can lead to a return to user space while the
request is still pending in the driver.  If userspace closes the sockets
before the requests are handled by the driver, this will lead to
use-after-frees (and potential crashes) in the kernel due to the tfm
having been freed.

The crashes can be easily reproduced (for example) by reducing the max
queue length in cryptod.c and running the following (from
http://www.chronox.de/libkcapi.html) on AES-NI capable hardware:

 $ while true; do kcapi -x 1 -e -c '__ecb-aes-aesni' \
    -k 00000000000000000000000000000000 \
    -p 00000000000000000000000000000000 >/dev/null & done

Signed-off-by: Rabin Vincent 
Signed-off-by: Herbert Xu 
Signed-off-by: Luis Henriques

crypto: af_alg - properly label AF_ALG socket

2014-07-31T13:54:00+00:00

Th AF_ALG socket was missing a security label (e.g. SELinux)
which means that socket was in "unlabeled" state.

This was recently demonstrated in the cryptsetup package
(cryptsetup v1.6.5 and later.)
See https://bugzilla.redhat.com/show_bug.cgi?id=1115120

This patch clones the sock's label from the parent sock
and resolves the issue (similar to AF_BLUETOOTH protocol family).

Cc: stable@vger.kernel.org
Signed-off-by: Milan Broz 
Acked-by: Paul Moore 
Signed-off-by: Herbert Xu