[PATCH v3] crypto: essiv: fix use-after-free in AEAD path

[PATCH v3] crypto: essiv: fix use-after-free in AEAD path

[Jérémy Jean]

The request that ESSIV submits to its wrapped AEAD transform may
finish before crypto_aead_encrypt() or crypto_aead_decrypt() returns.
In case this happens, essiv_aead_done() calls aead_request_complete()
on the original ESSIV request, which can end up freeing the request
before essiv_aead_crypt() resumes, creating a UAF:

  BUG: KASAN: slab-use-after-free in essiv_aead_crypt+0x8e6/0x950
  Read of size 8 at addr ffff888102af1360 by task init/66

Check the return status before dereferencing rctx after submitting that
request. If the operation did not return -EINPROGRESS or -EBUSY, then
the request cannot have been freed yet.

Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---

Changes in v3:
 - Code simplification.

Changes in v2:
 - Drop the local assoc variable and check the return status before
   dereferencing rctx, as requested by Herbert Xu.

v1: https://lore.kernel.org/linux-crypto/20261014222351.2930674-1-Jeremy.Jean@oss.cyber.gouv.fr/
v2: https://lore.kernel.org/linux-crypto/20261015121743.3151400-2-Jeremy.Jean@oss.cyber.gouv.fr/

 crypto/essiv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/essiv.c b/crypto/essiv.c
index a47a3eab6935..3505b2769d93 100644
--- a/crypto/essiv.c
+++ b/crypto/essiv.c
@@ -250,7 +250,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
 	err = enc ? crypto_aead_encrypt(subreq) :
 		    crypto_aead_decrypt(subreq);
 
-	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
-		kfree(rctx->assoc);
+	if (err != -EINPROGRESS && err != -EBUSY)
+		kfree(rctx->assoc);
 	return err;
 }
 
-- 
2.47.3

Re: [PATCH v3] crypto: essiv: fix use-after-free in AEAD path

[Herbert Xu]

On Fri, Oct 16, 2026 at 07:50:31AM +0000, Jérémy Jean wrote:
> The request that ESSIV submits to its wrapped AEAD transform may
> finish before crypto_aead_encrypt() or crypto_aead_decrypt() returns.
> In case this happens, essiv_aead_done() calls aead_request_complete()
> on the original ESSIV request, which can end up freeing the request
> before essiv_aead_crypt() resumes, creating a UAF:
> 
>   BUG: KASAN: slab-use-after-free in essiv_aead_crypt+0x8e6/0x950
>   Read of size 8 at addr ffff888102af1360 by task init/66
> 
> Check the return status before dereferencing rctx after submitting that
> request. If the operation did not return -EINPROGRESS or -EBUSY, then
> the request cannot have been freed yet.
> 
> Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
> 
> Changes in v3:
>  - Code simplification.
> 
> Changes in v2:
>  - Drop the local assoc variable and check the return status before
>    dereferencing rctx, as requested by Herbert Xu.
> 
> v1: https://lore.kernel.org/linux-crypto/20261014222351.2930674-1-Jeremy.Jean@oss.cyber.gouv.fr/
> v2: https://lore.kernel.org/linux-crypto/20261015121743.3151400-2-Jeremy.Jean@oss.cyber.gouv.fr/
> 
>  crypto/essiv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt