linux_dsm_epyc7002/drivers/crypto
Iuliana Prodan 5af4e8d448 crypto: caam - fix use-after-free KASAN issue for SKCIPHER algorithms
Here's the KASAN report:
BUG: KASAN: use-after-free in skcipher_crypt_done+0xe8/0x1a8
Read of size 1 at addr ffff00002304001c by task swapper/0/0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc1-00162-gfcb90d5 #57
Hardware name: LS1046A RDB Board (DT)
Call trace:
 dump_backtrace+0x0/0x260
 show_stack+0x14/0x20
 dump_stack+0xe8/0x144
 print_address_description.isra.11+0x64/0x348
 __kasan_report+0x11c/0x230
 kasan_report+0xc/0x18
 __asan_load1+0x5c/0x68
 skcipher_crypt_done+0xe8/0x1a8
 caam_jr_dequeue+0x390/0x608
 tasklet_action_common.isra.13+0x1ec/0x230
 tasklet_action+0x24/0x30
 efi_header_end+0x1a4/0x370
 irq_exit+0x114/0x128
 __handle_domain_irq+0x80/0xe0
 gic_handle_irq+0x50/0xa0
 el1_irq+0xb8/0x180
 _raw_spin_unlock_irq+0x2c/0x78
 finish_task_switch+0xa4/0x2f8
 __schedule+0x3a4/0x890
 schedule_idle+0x28/0x50
 do_idle+0x22c/0x338
 cpu_startup_entry+0x24/0x40
 rest_init+0xf8/0x10c
 arch_call_rest_init+0xc/0x14
 start_kernel+0x774/0x7b4

Allocated by task 263:
 save_stack+0x24/0xb0
 __kasan_kmalloc.isra.10+0xc4/0xe0
 kasan_kmalloc+0xc/0x18
 __kmalloc+0x178/0x2b8
 skcipher_edesc_alloc+0x21c/0x1018
 skcipher_encrypt+0x84/0x150
 crypto_skcipher_encrypt+0x50/0x68
 test_skcipher_vec_cfg+0x4d4/0xc10
 test_skcipher_vec+0xf8/0x1d8
 alg_test_skcipher+0xec/0x230
 alg_test.part.44+0x114/0x4a0
 alg_test+0x1c/0x60
 cryptomgr_test+0x34/0x58
 kthread+0x1b8/0x1c0
 ret_from_fork+0x10/0x18

Freed by task 0:
 save_stack+0x24/0xb0
 __kasan_slab_free+0x10c/0x188
 kasan_slab_free+0x10/0x18
 kfree+0x7c/0x298
 skcipher_crypt_done+0xe0/0x1a8
 caam_jr_dequeue+0x390/0x608
 tasklet_action_common.isra.13+0x1ec/0x230
 tasklet_action+0x24/0x30
 efi_header_end+0x1a4/0x370

The buggy address belongs to the object at ffff000023040000
 which belongs to the cache dma-kmalloc-512 of size 512
The buggy address is located 28 bytes inside of
 512-byte region [ffff000023040000, ffff000023040200)
The buggy address belongs to the page:
page:fffffe00006c1000 refcount:1 mapcount:0 mapping:ffff00093200c400 index:0x0 compound_mapcount: 0
flags: 0xffff00000010200(slab|head)
raw: 0ffff00000010200 dead000000000100 dead000000000122 ffff00093200c400
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff00002303ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff00002303ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff000023040000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff000023040080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff000023040100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

Fixes: ee38767f15 ("crypto: caam - support crypto_engine framework for SKCIPHER algorithms")
Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2020-04-16 16:48:56 +10:00
..
allwinner crypto: sun8i-ce - fix description of stat_fb 2020-03-06 12:28:21 +11:00
amcc crypto: crypto4xx - use GFP_KERNEL for big allocations 2020-01-09 11:30:53 +08:00
amlogic crypto: amlogic - fix removal of module 2020-01-16 15:18:12 +08:00
axis crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
bcm crypto: bcm - Use scnprintf() for avoiding potential buffer overflow 2020-03-20 14:36:51 +11:00
caam crypto: caam - fix use-after-free KASAN issue for SKCIPHER algorithms 2020-04-16 16:48:56 +10:00
cavium crypto: Replace zero-length array with flexible-array member 2020-03-06 12:28:21 +11:00
ccp crypto: ccp - use file mode for sev ioctl permissions 2020-03-12 23:00:15 +11:00
ccree crypto: ccree - remove duplicated include from cc_aead.c 2020-03-30 11:50:48 +11:00
chelsio Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-04-07 12:03:32 -07:00
hisilicon crypto: hisilicon - Fix build error 2020-04-03 15:37:26 +11:00
inside-secure crypto: remove propagation of CRYPTO_TFM_RES_* flags 2020-01-09 11:30:53 +08:00
marvell crypto: marvell/octeontx - fix double free of ptr 2020-04-03 15:37:26 +11:00
mediatek crypto: Replace zero-length array with flexible-array member 2020-03-06 12:28:21 +11:00
nx crypto: Replace zero-length array with flexible-array member 2020-03-06 12:28:21 +11:00
qat crypto: qat - simplify the qat_crypto function 2020-03-12 23:00:13 +11:00
qce crypto: qce - fix wrong config symbol reference 2020-03-12 23:00:13 +11:00
rockchip crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
stm32 crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
ux500 crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
virtio crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
vmx .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
xilinx crypto: xilinx - Add Xilinx AES driver 2020-02-28 08:36:46 +08:00
atmel-aes-regs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
atmel-aes.c crypto: atmel-{aes,sha,tdes} - Retire crypto_platform_data 2020-01-22 16:21:09 +08:00
atmel-authenc.h crypto: remove propagation of CRYPTO_TFM_RES_* flags 2020-01-09 11:30:53 +08:00
atmel-ecc.c crypto: atmel-ecc - factor out code that can be shared 2019-05-30 15:35:45 +08:00
atmel-i2c.c crypto: atmel-i2c - Fix wakeup fail 2020-03-20 14:36:51 +11:00
atmel-i2c.h crypto: atmel - Fix -Wunused-const-variable warning 2019-08-30 18:05:31 +10:00
atmel-sha204a.c crypto: atmel-sha204a - Use device-managed registration API 2019-08-02 14:43:59 +10:00
atmel-sha-regs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
atmel-sha.c crypto: atmel-{aes,sha,tdes} - Retire crypto_platform_data 2020-01-22 16:21:09 +08:00
atmel-tdes-regs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
atmel-tdes.c crypto: atmel-{aes,sha,tdes} - Retire crypto_platform_data 2020-01-22 16:21:09 +08:00
exynos-rng.c crypto: exynos - use devm_platform_ioremap_resource() to simplify code 2019-08-09 15:11:59 +10:00
geode-aes.c crypto: remove propagation of CRYPTO_TFM_RES_* flags 2020-01-09 11:30:53 +08:00
geode-aes.h crypto: geode-aes - convert to skcipher API and make thread-safe 2019-10-23 19:46:56 +11:00
hifn_795x.c remove ioremap_nocache and devm_ioremap_nocache 2020-01-06 09:45:59 +01:00
img-hash.c crypto: img-hash - Replace zero-length array with flexible-array member 2020-02-22 09:25:48 +08:00
ixp4xx_crypto.c crypto: remove CRYPTO_TFM_RES_WEAK_KEY 2020-01-09 11:30:53 +08:00
Kconfig crypto: marvell - create common Kconfig and Makefile for Marvell 2020-03-20 14:36:51 +11:00
Makefile crypto: marvell - create common Kconfig and Makefile for Marvell 2020-03-20 14:36:51 +11:00
mxs-dcp.c crypto: mxs-dcp - fix scatterlist linearization for hash 2020-03-06 12:28:21 +11:00
n2_asm.S License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
n2_core.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
n2_core.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
omap-aes-gcm.c crypto: omap-aes-gcm - convert to use crypto engine 2019-12-11 16:37:00 +08:00
omap-aes.c crypto: omap-aes-gcm - convert to use crypto engine 2019-12-11 16:37:00 +08:00
omap-aes.h crypto: omap-aes-gcm - convert to use crypto engine 2019-12-11 16:37:00 +08:00
omap-crypto.c crypto: omap-crypto - copy the temporary data to output buffer properly 2019-12-11 16:37:00 +08:00
omap-crypto.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
omap-des.c crypto: omap-des - handle NULL cipher request 2019-12-11 16:37:00 +08:00
omap-sham.c crypto: Replace zero-length array with flexible-array member 2020-03-06 12:28:21 +11:00
padlock-aes.c crypto: Convert to new CPU match macros 2020-03-24 21:36:06 +01:00
padlock-sha.c crypto: Convert to new CPU match macros 2020-03-24 21:36:06 +01:00
picoxcell_crypto_regs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
picoxcell_crypto.c crypto: remove propagation of CRYPTO_TFM_RES_* flags 2020-01-09 11:30:53 +08:00
qcom-rng.c crypto: qcom-rng - use devm_platform_ioremap_resource() to simplify code 2019-08-09 15:12:03 +10:00
s5p-sss.c crypto: s5p-sss - Replace zero-length array with flexible-array member 2020-02-22 09:25:48 +08:00
sahara.c crypto: remove propagation of CRYPTO_TFM_RES_* flags 2020-01-09 11:30:53 +08:00
talitos.c crypto: remove CRYPTO_TFM_RES_BAD_KEY_LEN 2020-01-09 11:30:53 +08:00
talitos.h crypto: talitos - drop icv_ool 2019-07-03 22:13:11 +08:00