Linux Virtualization - Jun 2020 - Patch "crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req()" has been added to the 5.6-stable tree

This is a note to let you know that I've just added the patch titled

    crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req()

to the 5.6-stable tree which can be found at:
   
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
    
crypto-virtio-fix-use-after-free-in-virtio_crypto_skcipher_finalize_req.patch
and it can be found in the queue-5.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.

>From 8c855f0720ff006d75d0a2512c7f6c4f60ff60ee Mon Sep 17 00:00:00 2001
From: "Longpeng(Mike)" <longpeng2 at huawei.com>
Date: Tue, 2 Jun 2020 15:05:00 +0800
Subject: crypto: virtio: Fix use-after-free in
virtio_crypto_skcipher_finalize_req()

From: Longpeng(Mike) <longpeng2 at huawei.com>

commit 8c855f0720ff006d75d0a2512c7f6c4f60ff60ee upstream.

The system'll crash when the users insmod crypto/tcrypto.ko with mode=155
( testing "authenc(hmac(sha1),cbc(aes))" ). It's caused by reuse
the memory
of request structure.

In crypto_authenc_init_tfm(), the reqsize is set to:
  [PART 1] sizeof(authenc_request_ctx) +
  [PART 2] ictx->reqoff +
  [PART 3] MAX(ahash part, skcipher part)
and the 'PART 3' is used by both ahash and skcipher in turn.

When the virtio_crypto driver finish skcipher req, it'll call ->complete
callback(in crypto_finalize_skcipher_request) and then free its
resources whose pointers are recorded in 'skcipher parts'.

However, the ->complete is 'crypto_authenc_encrypt_done' in this
case,
it will use the 'ahash part' of the request and change its content,
so virtio_crypto driver will get the wrong pointer after ->complete
finish and mistakenly free some other's memory. So the system will crash
when these memory will be used again.

The resources which need to be cleaned up are not used any more. But the
pointers of these resources may be changed in the function
"crypto_finalize_skcipher_request". Thus release specific resources
before
calling this function.

Fixes: dbaf0624ffa5 ("crypto: add virtio-crypto driver")
Reported-by: LABBE Corentin <clabbe at baylibre.com>
Cc: Gonglei <arei.gonglei at huawei.com>
Cc: Herbert Xu <herbert at gondor.apana.org.au>
Cc: "Michael S. Tsirkin" <mst at redhat.com>
Cc: Jason Wang <jasowang at redhat.com>
Cc: "David S. Miller" <davem at davemloft.net>
Cc: virtualization at lists.linux-foundation.org
Cc: linux-kernel at vger.kernel.org
Cc: stable at vger.kernel.org
Link: https://lore.kernel.org/r/20200123101000.GB24255 at Red
Acked-by: Gonglei <arei.gonglei at huawei.com>
Signed-off-by: Longpeng(Mike) <longpeng2 at huawei.com>
Link: https://lore.kernel.org/r/20200602070501.2023-3-longpeng2 at huawei.com
Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

---
 drivers/crypto/virtio/virtio_crypto_algs.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/crypto/virtio/virtio_crypto_algs.c
+++ b/drivers/crypto/virtio/virtio_crypto_algs.c
@@ -578,10 +578,11 @@ static void virtio_crypto_skcipher_final
 		scatterwalk_map_and_copy(req->iv, req->dst,
 					 req->cryptlen - AES_BLOCK_SIZE,
 					 AES_BLOCK_SIZE, 0);
-	crypto_finalize_skcipher_request(vc_sym_req->base.dataq->engine,
-					   req, err);
 	kzfree(vc_sym_req->iv);
 	virtcrypto_clear_request(&vc_sym_req->base);
+
+	crypto_finalize_skcipher_request(vc_sym_req->base.dataq->engine,
+					   req, err);
 }
 
 static struct virtio_crypto_algo virtio_crypto_algs[] = { {


Patches currently in stable-queue which might be from longpeng2 at huawei.com
are

queue-5.6/crypto-virtio-fix-src-dst-scatterlist-calculation-in-__virtio_crypto_skcipher_do_req.patch
queue-5.6/crypto-virtio-fix-dest-length-calculation-in-__virtio_crypto_skcipher_do_req.patch
queue-5.6/crypto-virtio-fix-use-after-free-in-virtio_crypto_skcipher_finalize_req.patch