From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, "PaX Team" <pageexec@freemail.hu>,
"Steffen Klassert" <steffen.klassert@secunet.com>,
"Herbert Xu" <herbert@gondor.apana.org.au>,
"Mathias Krause" <minipli@googlemail.com>
Subject: [PATCH 3.2 49/67] crypto: user - lock crypto_alg_list on alg dump
Date: Tue, 23 Feb 2016 21:42:03 +0000 [thread overview]
Message-ID: <lsq.1456263723.251390559@decadent.org.uk> (raw)
In-Reply-To: <lsq.1456263722.390955919@decadent.org.uk>
3.2.78-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <minipli@googlemail.com>
commit 63e41ebc6630f39422d87f8a4bade1e793f37a01 upstream.
We miss to take the crypto_alg_sem semaphore when traversing the
crypto_alg_list for CRYPTO_MSG_GETALG dumps. This allows a race with
crypto_unregister_alg() removing algorithms from the list while we're
still traversing it, thereby leading to a use-after-free as show below:
[ 3482.071639] general protection fault: 0000 [#1] SMP
[ 3482.075639] Modules linked in: aes_x86_64 glue_helper lrw ablk_helper cryptd gf128mul ipv6 pcspkr serio_raw virtio_net microcode virtio_pci virtio_ring virtio sr_mod cdrom [last unloaded: aesni_intel]
[ 3482.075639] CPU: 1 PID: 11065 Comm: crconf Not tainted 4.3.4-grsec+ #126
[ 3482.075639] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 3482.075639] task: ffff88001cd41a40 ti: ffff88001cd422c8 task.ti: ffff88001cd422c8
[ 3482.075639] RIP: 0010:[<ffffffff93722bd3>] [<ffffffff93722bd3>] strncpy+0x13/0x30
[ 3482.075639] RSP: 0018:ffff88001f713b60 EFLAGS: 00010202
[ 3482.075639] RAX: ffff88001f6c4430 RBX: ffff88001f6c43a0 RCX: ffff88001f6c4430
[ 3482.075639] RDX: 0000000000000040 RSI: fefefefefefeff16 RDI: ffff88001f6c4430
[ 3482.075639] RBP: ffff88001f713b60 R08: ffff88001f6c4470 R09: ffff88001f6c4480
[ 3482.075639] R10: 0000000000000002 R11: 0000000000000246 R12: ffff88001ce2aa28
[ 3482.075639] R13: ffff880000093700 R14: ffff88001f5e4bf8 R15: 0000000000003b20
[ 3482.075639] FS: 0000033826fa2700(0000) GS:ffff88001e900000(0000) knlGS:0000000000000000
[ 3482.075639] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3482.075639] CR2: ffffffffff600400 CR3: 00000000139ec000 CR4: 00000000001606f0
[ 3482.075639] Stack:
[ 3482.075639] ffff88001f713bd8 ffffffff936ccd00 ffff88001e5c4200 ffff880000093700
[ 3482.075639] ffff88001f713bd0 ffffffff938ef4bf 0000000000000000 0000000000003b20
[ 3482.075639] ffff88001f5e4bf8 ffff88001f5e4848 0000000000000000 0000000000003b20
[ 3482.075639] Call Trace:
[ 3482.075639] [<ffffffff936ccd00>] crypto_report_alg+0xc0/0x3e0
[ 3482.075639] [<ffffffff938ef4bf>] ? __alloc_skb+0x16f/0x300
[ 3482.075639] [<ffffffff936cd08a>] crypto_dump_report+0x6a/0x90
[ 3482.075639] [<ffffffff93935707>] netlink_dump+0x147/0x2e0
[ 3482.075639] [<ffffffff93935f99>] __netlink_dump_start+0x159/0x190
[ 3482.075639] [<ffffffff936ccb13>] crypto_user_rcv_msg+0xc3/0x130
[ 3482.075639] [<ffffffff936cd020>] ? crypto_report_alg+0x3e0/0x3e0
[ 3482.075639] [<ffffffff936cc4b0>] ? alg_test_crc32c+0x120/0x120
[ 3482.075639] [<ffffffff93933145>] ? __netlink_lookup+0xd5/0x120
[ 3482.075639] [<ffffffff936cca50>] ? crypto_add_alg+0x1d0/0x1d0
[ 3482.075639] [<ffffffff93938141>] netlink_rcv_skb+0xe1/0x130
[ 3482.075639] [<ffffffff936cc4f8>] crypto_netlink_rcv+0x28/0x40
[ 3482.075639] [<ffffffff939375a8>] netlink_unicast+0x108/0x180
[ 3482.075639] [<ffffffff93937c21>] netlink_sendmsg+0x541/0x770
[ 3482.075639] [<ffffffff938e31e1>] sock_sendmsg+0x21/0x40
[ 3482.075639] [<ffffffff938e4763>] SyS_sendto+0xf3/0x130
[ 3482.075639] [<ffffffff93444203>] ? bad_area_nosemaphore+0x13/0x20
[ 3482.075639] [<ffffffff93444470>] ? __do_page_fault+0x80/0x3a0
[ 3482.075639] [<ffffffff939d80cb>] entry_SYSCALL_64_fastpath+0x12/0x6e
[ 3482.075639] Code: 88 4a ff 75 ed 5d 48 0f ba 2c 24 3f c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 85 d2 48 89 f8 48 89 f9 4c 8d 04 17 48 89 e5 74 15 <0f> b6 16 80 fa 01 88 11 48 83 de ff 48 83 c1 01 4c 39 c1 75 eb
[ 3482.075639] RIP [<ffffffff93722bd3>] strncpy+0x13/0x30
To trigger the race run the following loops simultaneously for a while:
$ while : ; do modprobe aesni-intel; rmmod aesni-intel; done
$ while : ; do crconf show all > /dev/null; done
Fix the race by taking the crypto_alg_sem read lock, thereby preventing
crypto_unregister_alg() from modifying the algorithm list during the
dump.
This bug has been detected by the PaX memory sanitize feature.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: PaX Team <pageexec@freemail.hu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
crypto/crypto_user.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -390,8 +390,12 @@ static int crypto_user_rcv_msg(struct sk
if (link->dump == NULL)
return -EINVAL;
- return netlink_dump_start(crypto_nlsk, skb, nlh,
+ down_read(&crypto_alg_sem);
+ err = netlink_dump_start(crypto_nlsk, skb, nlh,
link->dump, link->done, 0);
+ up_read(&crypto_alg_sem);
+
+ return err;
}
err = nlmsg_parse(nlh, crypto_msg_min[type], attrs, CRYPTOCFGA_MAX,
next prev parent reply other threads:[~2016-02-23 21:46 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-23 21:42 [PATCH 3.2 00/67] 3.2.78-rc1 review Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 51/67] klist: fix starting point removed bug in klist iterators Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 40/67] Revert "xhci: don't finish a TD if we get a short-transfer event mid TD" Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 54/67] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 38/67] ALSA: rawmidi: Fix race at copying & updating the position Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 08/67] af_unix: fix struct pid memory leak Ben Hutchings
2016-02-23 22:07 ` Rainer Weikusat
2016-02-24 21:24 ` Ben Hutchings
2016-02-25 7:26 ` Willy Tarreau
2016-02-23 21:42 ` [PATCH 3.2 64/67] pipe: limit the per-user amount of pages allocated in pipes Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 42/67] xhci: Fix list corruption in urb dequeue at host removal Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 31/67] ALSA: seq: Fix race at closing in virmidi driver Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 10/67] sctp: allow setting SCTP_SACK_IMMEDIATELY by the application Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 09/67] pptp: fix illegal memory access caused by multiple bind()s Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 48/67] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 45/67] [media] saa7134-alsa: Only frees registered sound cards Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 62/67] unix: properly account for FDs passed over unix sockets Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 34/67] ALSA: seq: Fix yet another races among ALSA timer accesses Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 30/67] intel_scu_ipcutil: underflow in scu_reg_access() Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 43/67] [media] tda1004x: only update the frontend properties if locked Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 02/67] hrtimer: Handle remaining time proper for TIME_LOW_RES Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 16/67] ALSA: seq: Degrade the error message for too many opens Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 14/67] USB: serial: option: Adding support for Telit LE922 Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 55/67] sctp: translate network order to host order when users get a hmacid Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 52/67] ALSA: dummy: Implement timer backend switching more safely Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 63/67] unix: correctly track in-flight fds in sending process user_struct Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 53/67] ALSA: timer: Fix wrong instance passed to slave callbacks Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 01/67] KVM: vmx: fix MPX detection Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 06/67] usb: cdc-acm: send zero packet for intel 7260 modem Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 05/67] itimers: Handle relative timers with CONFIG_TIME_LOW_RES proper Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 66/67] pipe: Fix buffer offset after partially failed read Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 26/67] ALSA: dummy: Disable switching timer backend via sysfs Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 04/67] posix-timers: Handle relative timers with CONFIG_TIME_LOW_RES proper Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 13/67] USB: serial: visor: fix crash on detecting device without write_urbs Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 20/67] virtio_pci: fix use after free on release Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 18/67] PCI/AER: Flush workqueue on device remove to avoid use-after-free Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 35/67] ALSA: timer: Fix link corruption due to double start or stop Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 11/67] USB: cp210x: add ID for IAI USB to RS485 adaptor Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 15/67] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 61/67] ALSA: usb-audio: avoid freeing umidi object twice Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 25/67] crypto: shash - Fix has_key setting Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 03/67] timerfd: Handle relative timers with CONFIG_TIME_LOW_RES proper Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 44/67] ALSA: timer: Fix leftover link at closing Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 50/67] crypto: algif_skcipher - Do not dereference ctx without socket lock Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 29/67] crypto: algif_hash - wait for crypto_ahash_init() to complete Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 47/67] mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 07/67] cdc-acm:exclude Samsung phone 04e8:685d Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 46/67] scsi_dh_rdac: always retry MODE SELECT on command lock violation Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 24/67] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 28/67] x86/mm/pat: Avoid truncation when converting cpa->numpages to address Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 27/67] drm/vmwgfx: respect 'nomodeset' Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 32/67] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 17/67] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 12/67] USB: visor: fix null-deref at probe Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 36/67] libata: fix sff host state machine locking while polling Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 56/67] ALSA: timer: Fix race between stop and interrupt Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 60/67] btrfs: properly set the termination value of ctx->pos in readdir Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 19/67] libata: disable forced PORTS_IMPL for >= AHCI 1.3 Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 39/67] ALSA: seq: Fix lockdep warnings due to double mutex locks Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 33/67] ALSA: pcm: Fix potential deadlock in OSS emulation Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 23/67] SCSI: fix crashes in sd and sr runtime PM Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 57/67] ALSA: timer: Fix race at concurrent reads Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 58/67] ahci: Intel DNV device IDs SATA Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 65/67] iw_cxgb3: Fix incorrectly returning error on success Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 37/67] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free Ben Hutchings
2016-02-23 21:42 ` Ben Hutchings [this message]
2016-02-23 21:42 ` [PATCH 3.2 41/67] usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 22/67] perf annotate browser: Fix behaviour of Shift-Tab with nothing focussed Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 67/67] sched: fix __sched_setscheduler() vs load balancing race Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 59/67] ARM: 8519/1: ICST: try other dividends than 1 Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 21/67] rfkill: fix rfkill_fop_read wait_event usage Ben Hutchings
2016-02-24 0:48 ` [PATCH 3.2 00/67] 3.2.78-rc1 review Ben Hutchings
2016-02-24 2:48 ` Guenter Roeck
2016-02-24 14:41 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1456263723.251390559@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=herbert@gondor.apana.org.au \
--cc=linux-kernel@vger.kernel.org \
--cc=minipli@googlemail.com \
--cc=pageexec@freemail.hu \
--cc=stable@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®