GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-07-23 23:32:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

crypto: user - fix use_after_free of struct xxx_request

Browse source 
All crypto_stats functions use the struct xxx_request for feeding stats,
but in some case this structure could already be freed.

For fixing this, the needed parameters (len and alg) will be stored
before the request being executed.
Fixes: cac5818c25 ("crypto: user - Implement a generic crypto statistics")
Reported-by: syzbot <syzbot+6939a606a5305e9e9799@syzkaller.appspotmail.com>

Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Corentin Labbe 2018-11-29 14:42:21 +00:00 • committed by Herbert Xu
parent 76d09ea7c2
commit f7d76e05d0
11 changed files with 376 additions and 276 deletions
Download patch file Download diff file Expand all files Collapse all files

27
include/crypto/rng.h
View file

@ -122,29 +122,6 @@ static inline void crypto_free_rng(struct crypto_rng *tfm)
crypto_destroy_tfm(tfm, crypto_rng_tfm(tfm));
}
static inline void crypto_stat_rng_seed(struct crypto_rng *tfm, int ret)
{
#ifdef CONFIG_CRYPTO_STATS
if (ret && ret != -EINPROGRESS && ret != -EBUSY)
atomic64_inc(&tfm->base.__crt_alg->rng_err_cnt);
else
atomic64_inc(&tfm->base.__crt_alg->seed_cnt);
#endif
}
static inline void crypto_stat_rng_generate(struct crypto_rng *tfm,
unsigned int dlen, int ret)
{
#ifdef CONFIG_CRYPTO_STATS
if (ret && ret != -EINPROGRESS && ret != -EBUSY) {
atomic64_inc(&tfm->base.__crt_alg->rng_err_cnt);
} else {
atomic64_inc(&tfm->base.__crt_alg->generate_cnt);
atomic64_add(dlen, &tfm->base.__crt_alg->generate_tlen);
}
#endif
}
/**
* crypto_rng_generate() - get random number
* @tfm: cipher handle
@ -163,10 +140,12 @@ static inline int crypto_rng_generate(struct crypto_rng *tfm,
const u8 *src, unsigned int slen,
u8 *dst, unsigned int dlen)
{
struct crypto_alg *alg = tfm->base.__crt_alg;
int ret;
crypto_stats_get(alg);
ret = crypto_rng_alg(tfm)->generate(tfm, src, slen, dst, dlen);
crypto_stat_rng_generate(tfm, dlen, ret);
crypto_stats_rng_generate(alg, dlen, ret);
return ret;
}