lkml.org 
[lkml]   [2020]   [Jun]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: WARNING: refcount bug in crypto_mod_get
On Fri, May 01, 2020 at 10:01:14AM -0700, syzbot wrote:
>
> ------------[ cut here ]------------
> refcount_t: addition on 0; use-after-free.
...
> refcount_add include/linux/refcount.h:204 [inline]
> refcount_inc include/linux/refcount.h:241 [inline]
> crypto_alg_get crypto/internal.h:87 [inline]
> crypto_mod_get+0xc6/0xf0 crypto/api.c:37
> crypto_spawn_alg.isra.0+0xa8/0x110 crypto/algapi.c:723
> crypto_spawn_tfm2+0x19/0xb0 crypto/algapi.c:763
> crypto_spawn_aead include/crypto/internal/aead.h:102 [inline]
> pcrypt_aead_init_tfm+0x144/0x273 crypto/pcrypt.c:182
> crypto_aead_init_tfm+0x138/0x1a0 crypto/aead.c:140
> crypto_create_tfm+0xd5/0x2f0 crypto/api.c:454
> crypto_alloc_tfm+0x100/0x340 crypto/api.c:526
> aead_bind+0x69/0x170 crypto/algif_aead.c:483
> alg_bind+0x260/0x530 crypto/af_alg.c:182
> __sys_bind+0x20e/0x250 net/socket.c:1662
> __do_sys_bind net/socket.c:1673 [inline]
> __se_sys_bind net/socket.c:1671 [inline]
> __x64_sys_bind+0x6f/0xb0 net/socket.c:1671
> do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
> entry_SYSCALL_64_after_hwframe+0x49/0xb3

This should be fixed already:

#syz fix: crypto: api - Fix use-after-free and race in crypto_spawn_alg

Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

\
 
 \ /
  Last update: 2020-06-05 14:39    [W:0.157 / U:0.296 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site