yangerkun d5ef0bcd42 crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async ... Nowdays, we trigger a oops: ... kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] SMP KASAN ... Call Trace: [<ffffffff81a26fb1>] skcipher_recvmsg_async+0x3f1/0x1400 x86/../crypto/algif_skcipher.c:543 [<ffffffff81a28053>] skcipher_recvmsg+0x93/0x7f0 x86/../crypto/algif_skcipher.c:723 [<ffffffff823e43a4>] sock_recvmsg_nosec x86/../net/socket.c:702 [inline] [<ffffffff823e43a4>] sock_recvmsg x86/../net/socket.c:710 [inline] [<ffffffff823e43a4>] sock_recvmsg+0x94/0xc0 x86/../net/socket.c:705 [<ffffffff823e464b>] sock_read_iter+0x27b/0x3a0 x86/../net/socket.c:787 [<ffffffff817f479b>] aio_run_iocb+0x21b/0x7a0 x86/../fs/aio.c:1520 [<ffffffff817f57c9>] io_submit_one x86/../fs/aio.c:1630 [inline] [<ffffffff817f57c9>] do_io_submit+0x6b9/0x10b0 x86/../fs/aio.c:1688 [<ffffffff817f902d>] SYSC_io_submit x86/../fs/aio.c:1713 [inline] [<ffffffff817f902d>] SyS_io_submit+0x2d/0x40 x86/../fs/aio.c:1710 [<ffffffff828b33c3>] tracesys_phase2+0x90/0x95 In skcipher_recvmsg_async, we use '!sreq->tsg' to determine does we calloc fail. However, kcalloc may return ZERO_SIZE_PTR, and with this, the latter sg_init_table will trigger the bug. Fix it be use ZERO_OF_NULL_PTR. This function was introduced with ' commit a596999b7ddf ("crypto: algif - change algif_skcipher to be asynchronous")', and has been removed with 'commit e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")'. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: yangerkun <yangerkun@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-04-07 14:10:51 +02:00
..
asymmetric_keys
async_tx
842.c
ablk_helper.c
ablkcipher.c
aead.c
aes_generic.c
af_alg.c	crypto: af_alg - Use bh_lock_sock in sk_destruct	2020-04-07 13:46:00 +02:00
ahash.c
akcipher.c
algapi.c	crypto: api - Fix race condition in crypto_spawn_alg	2020-04-07 13:50:06 +02:00
algboss.c
algif_aead.c
algif_hash.c
algif_rng.c
algif_skcipher.c	crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async	2020-04-07 14:10:51 +02:00
ansi_cprng.c
anubis.c
api.c	crypto: api - Fix race condition in crypto_spawn_alg	2020-04-07 13:50:06 +02:00
arc4.c
authenc.c
authencesn.c
blkcipher.c
blowfish_common.c
blowfish_generic.c
camellia_generic.c
cast_common.c
cast5_generic.c
cast6_generic.c
cbc.c
ccm.c
chacha20_generic.c
chacha20poly1305.c	crypto: chacha20poly1305 - set cra_name correctly	2020-04-06 18:12:51 +02:00
chainiv.c
cipher.c
cmac.c
compress.c
crc32.c
crc32c_generic.c
crct10dif_common.c
crct10dif_generic.c
cryptd.c
crypto_null.c
crypto_user.c	crypto: user - fix memory leak in crypto_report	2020-04-07 12:46:03 +02:00
crypto_wq.c
ctr.c
cts.c
deflate.c
des_generic.c
drbg.c
ecb.c
echainiv.c
eseqiv.c
fcrypt.c
fips.c
gcm.c	crypto: gcm - fix incompatibility between "gcm" and "gcm_base"	2020-04-06 18:12:49 +02:00
gf128mul.c
ghash-generic.c	crypto: ghash - fix unaligned memory access in ghash_setkey()	2020-04-06 19:55:45 +02:00
hash_info.c
heh.c
hmac.c
internal.h	crypto: api - Fix race condition in crypto_spawn_alg	2020-04-07 13:50:06 +02:00
jitterentropy-kcapi.c
jitterentropy.c
Kconfig
keywrap.c
khazad.c
lrw.c
lz4.c
lz4hc.c
lzo.c
Makefile
mcryptd.c
md4.c
md5.c
memneq.c
michael_mic.c
pcbc.c
pcompress.c
pcrypt.c	crypto: pcrypt - Do not clear MAY_SLEEP flag in original request	2020-04-07 13:50:04 +02:00
poly1305_generic.c
proc.c
ripemd.h
rmd128.c
rmd160.c
rmd256.c
rmd320.c
rng.c
rsa_helper.c
rsa.c
rsaprivkey.asn1
rsapubkey.asn1
salsa20_generic.c	crypto: salsa20 - don't access already-freed walk.iv	2020-04-06 18:12:53 +02:00
scatterwalk.c
seed.c
seqiv.c
serpent_generic.c
sha1_generic.c
sha256_generic.c
sha512_generic.c
shash.c
skcipher.c
tcrypt.c
tcrypt.h
tea.c
testmgr.c
testmgr.h
tgr192.c	crypto: tgr192 - fix unaligned memory access	2020-04-07 13:40:09 +02:00
twofish_common.c
twofish_generic.c
vmac.c
wp512.c
xcbc.c
xor.c
xts.c
zlib.c
zstd.c