[PATCH v2] crypto: essiv: fix use-after-free in AEAD path

[PATCH v2] crypto: essiv: fix use-after-free in AEAD path

[Jérémy Jean]

The request that ESSIV submits to its wrapped AEAD transform may
finish before crypto_aead_encrypt() or crypto_aead_decrypt() returns.
In case this happens, essiv_aead_done() calls aead_request_complete()
on the original ESSIV request, which can end up freeing the request
before essiv_aead_crypt() resumes, creating a UAF:

  BUG: KASAN: slab-use-after-free in essiv_aead_crypt+0x8e6/0x950
  Read of size 8 at addr ffff888102af1360 by task init/66

Keep the temporary assoc pointer in a local variable before submitting
that request.

Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---

Changes in v2:
 - Drop the NULL check before kfree(), as requested by Herbert Xu.

v1: https://lore.kernel.org/linux-crypto/dcf362bd924d7090dbd03ef8af7a6ece@oss.cyber.gouv.fr/T/

 crypto/essiv.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/crypto/essiv.c b/crypto/essiv.c
index a47a3eab6935..8dcaef823c05 100644
--- a/crypto/essiv.c
+++ b/crypto/essiv.c
@@ -189,6 +189,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
 	int ivsize = crypto_aead_ivsize(tfm);
 	int ssize = req->assoclen - ivsize;
 	struct scatterlist *src = req->src;
+	u8 *assoc;
 	int err;
 
 	if (ssize < 0)
@@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
 				  essiv_aead_done, req);
 	aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv);
 
+	assoc = rctx->assoc;
 	err = enc ? crypto_aead_encrypt(subreq) :
 		    crypto_aead_decrypt(subreq);
 
-	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
-		kfree(rctx->assoc);
+	if (err != -EINPROGRESS && err != -EBUSY)
+		kfree(assoc);
 	return err;
 }
 
-- 
2.47.3

Re: [PATCH v2] crypto: essiv: fix use-after-free in AEAD path

[Herbert Xu]

On Thu, Oct 15, 2026 at 12:17:43PM +0000, Jérémy Jean wrote:
>
> @@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
>  				  essiv_aead_done, req);
>  	aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv);
>  
> +	assoc = rctx->assoc;
>  	err = enc ? crypto_aead_encrypt(subreq) :
>  		    crypto_aead_decrypt(subreq);
>  
> -	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
> -		kfree(rctx->assoc);
> +	if (err != -EINPROGRESS && err != -EBUSY)
> +		kfree(assoc);

There is no need for assoc at all once the rctx->assoc test is
dropped.  If the condition is true then rctx cannot have been
freed.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH v2] crypto: essiv: fix use-after-free in AEAD path

[Jérémy Jean]

On 2026-10-15 14:19, Herbert Xu wrote:
> On Thu, Oct 15, 2026 at 12:17:43PM +0000, Jérémy Jean wrote:
>> 
>> @@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request 
>> *req, bool enc)
>>  				  essiv_aead_done, req);
>>  	aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, 
>> req->iv);
>> 
>> +	assoc = rctx->assoc;
>>  	err = enc ? crypto_aead_encrypt(subreq) :
>>  		    crypto_aead_decrypt(subreq);
>> 
>> -	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
>> -		kfree(rctx->assoc);
>> +	if (err != -EINPROGRESS && err != -EBUSY)
>> +		kfree(assoc);
> 
> There is no need for assoc at all once the rctx->assoc test is
> dropped.  If the condition is true then rctx cannot have been
> freed.

Indeed, you are totally right, this is definitely simpler, thanks.
Do you prefer I resend a v2 or send a v3?

diff --git a/crypto/essiv.c b/crypto/essiv.c
index a47a3eab6935..3505b2769d93 100644
--- a/crypto/essiv.c
+++ b/crypto/essiv.c
@@ -250,7 +250,7 @@ static int essiv_aead_crypt(struct aead_request 
*req, bool enc)
         err = enc ? crypto_aead_encrypt(subreq) :
                     crypto_aead_decrypt(subreq);

-       if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
-               kfree(rctx->assoc);
+       if (err != -EINPROGRESS && err != -EBUSY)
+               kfree(rctx->assoc);
         return err;
  }

Re: [PATCH v2] crypto: essiv: fix use-after-free in AEAD path

[Herbert Xu]

On Thu, Oct 15, 2026 at 03:33:45PM +0200, Jérémy Jean wrote:
>
> Indeed, you are totally right, this is definitely simpler, thanks.
> Do you prefer I resend a v2 or send a v3?

Please resend a v3.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt