Re: [PATCH] crypto: pcrypt - fix freeing pcrypt instances

2017-12-22 Thread Herbert Xu
On Wed, Dec 20, 2017 at 02:28:25PM -0800, Eric Biggers wrote:
> From: Eric Biggers 
> 
> pcrypt is using the old way of freeing instances, where the ->free()
> method specified in the 'struct crypto_template' is passed a pointer to
> the 'struct crypto_instance'.  But the crypto_instance is being
> kfree()'d directly, which is incorrect because the memory was actually
> allocated as an aead_instance, which contains the crypto_instance at a
> nonzero offset.  Thus, the wrong pointer was being kfree()'d.
> 
> Fix it by switching to the new way to free aead_instance's where the
> ->free() method is specified in the aead_instance itself.
> 
> Reported-by: syzbot 
> Fixes: 0496f56065e0 ("crypto: pcrypt - Add support for new AEAD interface")
> Cc:  # v4.2+
> Signed-off-by: Eric Biggers 

Patch applied.  Thanks.
-- 
Email: Herbert Xu 
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt


Re: [PATCH] crypto: pcrypt - fix freeing pcrypt instances

2017-12-21 Thread Dmitry Vyukov
On Wed, Dec 20, 2017 at 11:28 PM, Eric Biggers  wrote:
> From: Eric Biggers 
>
> pcrypt is using the old way of freeing instances, where the ->free()
> method specified in the 'struct crypto_template' is passed a pointer to
> the 'struct crypto_instance'.  But the crypto_instance is being
> kfree()'d directly, which is incorrect because the memory was actually
> allocated as an aead_instance, which contains the crypto_instance at a
> nonzero offset.  Thus, the wrong pointer was being kfree()'d.


That's interesting. KASAN does not detect frees of invalid pointers
(e.g. into a middle of an object). It should.
I've requested a component for KASAN in kernel bugzilla to file this
(not sure if anybody is actually reading these emails), and so far
filed it in an internal bug tracker.


> Fix it by switching to the new way to free aead_instance's where the
> ->free() method is specified in the aead_instance itself.
>
> Reported-by: syzbot 
> Fixes: 0496f56065e0 ("crypto: pcrypt - Add support for new AEAD interface")
> Cc:  # v4.2+
> Signed-off-by: Eric Biggers 
> ---
>  crypto/pcrypt.c | 19 ++-
>  1 file changed, 10 insertions(+), 9 deletions(-)
>
> diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
> index ee9cfb99fe25..f8ec3d4ba4a8 100644
> --- a/crypto/pcrypt.c
> +++ b/crypto/pcrypt.c
> @@ -254,6 +254,14 @@ static void pcrypt_aead_exit_tfm(struct crypto_aead *tfm)
> crypto_free_aead(ctx->child);
>  }
>
> +static void pcrypt_free(struct aead_instance *inst)
> +{
> +   struct pcrypt_instance_ctx *ctx = aead_instance_ctx(inst);
> +
> +   crypto_drop_aead(>spawn);
> +   kfree(inst);
> +}
> +
>  static int pcrypt_init_instance(struct crypto_instance *inst,
> struct crypto_alg *alg)
>  {
> @@ -319,6 +327,8 @@ static int pcrypt_create_aead(struct crypto_template 
> *tmpl, struct rtattr **tb,
> inst->alg.encrypt = pcrypt_aead_encrypt;
> inst->alg.decrypt = pcrypt_aead_decrypt;
>
> +   inst->free = pcrypt_free;
> +
> err = aead_register_instance(tmpl, inst);
> if (err)
> goto out_drop_aead;
> @@ -349,14 +359,6 @@ static int pcrypt_create(struct crypto_template *tmpl, 
> struct rtattr **tb)
> return -EINVAL;
>  }
>
> -static void pcrypt_free(struct crypto_instance *inst)
> -{
> -   struct pcrypt_instance_ctx *ctx = crypto_instance_ctx(inst);
> -
> -   crypto_drop_aead(>spawn);
> -   kfree(inst);
> -}
> -
>  static int pcrypt_cpumask_change_notify(struct notifier_block *self,
> unsigned long val, void *data)
>  {
> @@ -469,7 +471,6 @@ static void pcrypt_fini_padata(struct padata_pcrypt 
> *pcrypt)
>  static struct crypto_template pcrypt_tmpl = {
> .name = "pcrypt",
> .create = pcrypt_create,
> -   .free = pcrypt_free,
> .module = THIS_MODULE,
>  };
>
> --
> 2.15.1.620.gb9897f4670-goog
>
> --
> You received this message because you are subscribed to the Google Groups 
> "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to syzkaller-bugs+unsubscr...@googlegroups.com.
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/syzkaller-bugs/20171220222825.207321-1-ebiggers3%40gmail.com.
> For more options, visit https://groups.google.com/d/optout.


[PATCH] crypto: pcrypt - fix freeing pcrypt instances

2017-12-20 Thread Eric Biggers
From: Eric Biggers 

pcrypt is using the old way of freeing instances, where the ->free()
method specified in the 'struct crypto_template' is passed a pointer to
the 'struct crypto_instance'.  But the crypto_instance is being
kfree()'d directly, which is incorrect because the memory was actually
allocated as an aead_instance, which contains the crypto_instance at a
nonzero offset.  Thus, the wrong pointer was being kfree()'d.

Fix it by switching to the new way to free aead_instance's where the
->free() method is specified in the aead_instance itself.

Reported-by: syzbot 
Fixes: 0496f56065e0 ("crypto: pcrypt - Add support for new AEAD interface")
Cc:  # v4.2+
Signed-off-by: Eric Biggers 
---
 crypto/pcrypt.c | 19 ++-
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index ee9cfb99fe25..f8ec3d4ba4a8 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -254,6 +254,14 @@ static void pcrypt_aead_exit_tfm(struct crypto_aead *tfm)
crypto_free_aead(ctx->child);
 }
 
+static void pcrypt_free(struct aead_instance *inst)
+{
+   struct pcrypt_instance_ctx *ctx = aead_instance_ctx(inst);
+
+   crypto_drop_aead(>spawn);
+   kfree(inst);
+}
+
 static int pcrypt_init_instance(struct crypto_instance *inst,
struct crypto_alg *alg)
 {
@@ -319,6 +327,8 @@ static int pcrypt_create_aead(struct crypto_template *tmpl, 
struct rtattr **tb,
inst->alg.encrypt = pcrypt_aead_encrypt;
inst->alg.decrypt = pcrypt_aead_decrypt;
 
+   inst->free = pcrypt_free;
+
err = aead_register_instance(tmpl, inst);
if (err)
goto out_drop_aead;
@@ -349,14 +359,6 @@ static int pcrypt_create(struct crypto_template *tmpl, 
struct rtattr **tb)
return -EINVAL;
 }
 
-static void pcrypt_free(struct crypto_instance *inst)
-{
-   struct pcrypt_instance_ctx *ctx = crypto_instance_ctx(inst);
-
-   crypto_drop_aead(>spawn);
-   kfree(inst);
-}
-
 static int pcrypt_cpumask_change_notify(struct notifier_block *self,
unsigned long val, void *data)
 {
@@ -469,7 +471,6 @@ static void pcrypt_fini_padata(struct padata_pcrypt *pcrypt)
 static struct crypto_template pcrypt_tmpl = {
.name = "pcrypt",
.create = pcrypt_create,
-   .free = pcrypt_free,
.module = THIS_MODULE,
 };
 
-- 
2.15.1.620.gb9897f4670-goog