a7y18lte-ubports/android_kernel_samsung_a7y18lte
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
2023-04-04-hybris
android_kernel_samsung_a7y1.../crypto
History
yangerkun d5ef0bcd42 crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async 
Nowdays, we trigger a oops:
...
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] SMP KASAN
...
Call Trace:
 [<ffffffff81a26fb1>] skcipher_recvmsg_async+0x3f1/0x1400 x86/../crypto/algif_skcipher.c:543
 [<ffffffff81a28053>] skcipher_recvmsg+0x93/0x7f0 x86/../crypto/algif_skcipher.c:723
 [<ffffffff823e43a4>] sock_recvmsg_nosec x86/../net/socket.c:702 [inline]
 [<ffffffff823e43a4>] sock_recvmsg x86/../net/socket.c:710 [inline]
 [<ffffffff823e43a4>] sock_recvmsg+0x94/0xc0 x86/../net/socket.c:705
 [<ffffffff823e464b>] sock_read_iter+0x27b/0x3a0 x86/../net/socket.c:787
 [<ffffffff817f479b>] aio_run_iocb+0x21b/0x7a0 x86/../fs/aio.c:1520
 [<ffffffff817f57c9>] io_submit_one x86/../fs/aio.c:1630 [inline]
 [<ffffffff817f57c9>] do_io_submit+0x6b9/0x10b0 x86/../fs/aio.c:1688
 [<ffffffff817f902d>] SYSC_io_submit x86/../fs/aio.c:1713 [inline]
 [<ffffffff817f902d>] SyS_io_submit+0x2d/0x40 x86/../fs/aio.c:1710
 [<ffffffff828b33c3>] tracesys_phase2+0x90/0x95

In skcipher_recvmsg_async, we use '!sreq->tsg' to determine does we
calloc fail. However, kcalloc may return ZERO_SIZE_PTR, and with this,
the latter sg_init_table will trigger the bug. Fix it be use ZERO_OF_NULL_PTR.

This function was introduced with ' commit a596999b7ddf ("crypto:
algif - change algif_skcipher to be asynchronous")', and has been removed
with 'commit e870456d8e7c ("crypto: algif_skcipher - overhaul memory
management")'.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: yangerkun <yangerkun@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-07 14:10:51 +02:00
..
asymmetric_keys A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
async_tx A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
842.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ablk_helper.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ablkcipher.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
aead.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
aes_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
af_alg.c crypto: af_alg - Use bh_lock_sock in sk_destruct 2020-04-07 13:46:00 +02:00
ahash.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
akcipher.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
algapi.c crypto: api - Fix race condition in crypto_spawn_alg 2020-04-07 13:50:06 +02:00
algboss.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
algif_aead.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
algif_hash.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
algif_rng.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
algif_skcipher.c crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async 2020-04-07 14:10:51 +02:00
ansi_cprng.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
anubis.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
api.c crypto: api - Fix race condition in crypto_spawn_alg 2020-04-07 13:50:06 +02:00
arc4.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
authenc.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
authencesn.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
blkcipher.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
blowfish_common.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
blowfish_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
camellia_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
cast_common.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
cast5_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
cast6_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
cbc.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ccm.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
chacha20_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
chacha20poly1305.c crypto: chacha20poly1305 - set cra_name correctly 2020-04-06 18:12:51 +02:00
chainiv.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
cipher.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
cmac.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
compress.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
crc32.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
crc32c_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
crct10dif_common.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
crct10dif_generic.c crypto: crct10dif-generic - fix use via crypto_shash_digest() 2020-04-06 18:12:14 +02:00
cryptd.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
crypto_null.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
crypto_user.c crypto: user - fix memory leak in crypto_report 2020-04-07 12:46:03 +02:00
crypto_wq.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ctr.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
cts.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
deflate.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
des_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
drbg.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ecb.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
echainiv.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
eseqiv.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
fcrypt.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
fips.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
gcm.c crypto: gcm - fix incompatibility between "gcm" and "gcm_base" 2020-04-06 18:12:49 +02:00
gf128mul.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ghash-generic.c crypto: ghash - fix unaligned memory access in ghash_setkey() 2020-04-06 19:55:45 +02:00
hash_info.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
heh.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
hmac.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
internal.h crypto: api - Fix race condition in crypto_spawn_alg 2020-04-07 13:50:06 +02:00
jitterentropy-kcapi.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
jitterentropy.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
Kconfig A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
keywrap.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
khazad.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
lrw.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
lz4.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
lz4hc.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
lzo.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
Makefile A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
mcryptd.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
md4.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
md5.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
memneq.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
michael_mic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
pcbc.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
pcompress.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
pcrypt.c crypto: pcrypt - Do not clear MAY_SLEEP flag in original request 2020-04-07 13:50:04 +02:00
poly1305_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
proc.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ripemd.h A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
rmd128.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
rmd160.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
rmd256.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
rmd320.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
rng.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
rsa_helper.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
rsa.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
rsaprivkey.asn1 A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
rsapubkey.asn1 A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
salsa20_generic.c crypto: salsa20 - don't access already-freed walk.iv 2020-04-06 18:12:53 +02:00
scatterwalk.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
seed.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
seqiv.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
serpent_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
sha1_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
sha256_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
sha512_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
shash.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
skcipher.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
tcrypt.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
tcrypt.h A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
tea.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
testmgr.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
testmgr.h crypto: x86/poly1305 - fix overflow during partial reduction 2020-04-06 15:51:38 +02:00
tgr192.c crypto: tgr192 - fix unaligned memory access 2020-04-07 13:40:09 +02:00
twofish_common.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
twofish_generic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
vmac.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
wp512.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
xcbc.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
xor.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
xts.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
zlib.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
zstd.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30