linux-bl808/crypto
Herbert Xu 34c86f4c4a crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()
The locking in af_alg_release_parent is broken as the BH socket
lock can only be taken if there is a code-path to handle the case
where the lock is owned by process-context.  Instead of adding
such handling, we can fix this by changing the ref counts to
atomic_t.

This patch also modifies the main refcnt to include both normal
and nokey sockets.  This way we don't have to fudge the nokey
ref count when a socket changes from nokey to normal.

Credits go to Mauricio Faria de Oliveira who diagnosed this bug
and sent a patch for it:

https://lore.kernel.org/linux-crypto/20200605161657.535043-1-mfo@canonical.com/

Reported-by: Brian Moyles <bmoyles@netflix.com>
Reported-by: Mauricio Faria de Oliveira <mfo@canonical.com>
Fixes: 37f96694cf ("crypto: af_alg - Use bh_lock_sock in...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2020-06-18 17:09:54 +10:00
..
asymmetric_keys
async_tx
842.c
acompress.c
adiantum.c
aead.c
aegis.h
aegis128-core.c
aegis128-neon-inner.c
aegis128-neon.c
aes_generic.c
aes_ti.c
af_alg.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-06-18 17:09:54 +10:00
ahash.c
akcipher.c
algapi.c crypto: algapi - create function to add request in front of queue 2020-05-08 15:30:40 +10:00
algboss.c crypto: algboss - don't wait during notifier callback 2020-06-15 17:38:54 +10:00
algif_aead.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-06-18 17:09:54 +10:00
algif_hash.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-06-18 17:09:54 +10:00
algif_rng.c crypto: algif_rng - remove redundant assignment to variable err 2020-04-24 17:42:16 +10:00
algif_skcipher.c crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-06-18 17:09:54 +10:00
ansi_cprng.c
anubis.c
api.c crypto: api - Fix use-after-free and race in crypto_spawn_alg 2020-04-16 16:49:22 +10:00
arc4.c
authenc.c
authencesn.c crypto: authencesn - fix weird comma-terminated line 2020-03-06 12:28:22 +11:00
blake2b_generic.c crypto: blake2b - Fix clang optimization for ARMv7-M 2020-05-15 16:15:00 +10:00
blake2s_generic.c
blowfish_common.c
blowfish_generic.c
camellia_generic.c
cast5_generic.c
cast6_generic.c
cast_common.c
cbc.c
ccm.c crypto: ccm - simplify error handling in crypto_rfc4309_create() 2020-03-06 12:28:22 +11:00
cfb.c
chacha20poly1305.c
chacha_generic.c
cipher.c
cmac.c
compress.c
crc32_generic.c
crc32c_generic.c
crct10dif_common.c
crct10dif_generic.c
cryptd.c crypto: cryptd - simplify error handling in cryptd_create_*() 2020-03-06 12:28:22 +11:00
crypto_engine.c crypto: engine - do not requeue in case of fatal error 2020-05-28 17:27:52 +10:00
crypto_null.c
crypto_user_base.c
crypto_user_stat.c
ctr.c crypto: ctr - simplify error handling in crypto_rfc3686_create() 2020-03-06 12:28:22 +11:00
cts.c crypto: cts - simplify error handling in crypto_cts_create() 2020-03-06 12:28:23 +11:00
curve25519-generic.c
deflate.c
des_generic.c
dh.c
dh_helper.c
drbg.c crypto: drbg - always try to free Jitter RNG instance 2020-06-15 17:38:54 +10:00
ecb.c
ecc.c
ecc.h
ecc_curve_defs.h
ecdh.c
ecdh_helper.c
echainiv.c
ecrdsa.c
ecrdsa_defs.h
ecrdsa_params.asn1
ecrdsa_pub_key.asn1
essiv.c crypto: essiv - use crypto_shash_tfm_digest() 2020-05-08 15:32:13 +10:00
fcrypt.c
fips.c
gcm.c crypto: gcm - simplify error handling in crypto_rfc4543_create() 2020-03-06 12:28:23 +11:00
geniv.c crypto: geniv - simply error handling in aead_geniv_alloc() 2020-03-06 12:28:23 +11:00
gf128mul.c
ghash-generic.c
hash_info.c crypto: rename sm3-256 to sm3 in hash_algo_name 2020-02-18 07:35:49 -05:00
hmac.c
internal.h crypto: api - Fix use-after-free and race in crypto_spawn_alg 2020-04-16 16:49:22 +10:00
jitterentropy-kcapi.c crypto: jitter - SP800-90B compliance 2020-04-24 17:42:17 +10:00
jitterentropy.c crypto: jitter - SP800-90B compliance 2020-04-24 17:42:17 +10:00
jitterentropy.h
Kconfig Merge branch 'rwonce/rework' of git://git.kernel.org/pub/scm/linux/kernel/git/will/linux 2020-06-10 14:46:54 -07:00
keywrap.c
khazad.c
kpp.c
lrw.c crypto - Avoid free() namespace collision 2020-05-08 15:30:41 +10:00
lz4.c
lz4hc.c
lzo-rle.c
lzo.c
Makefile
md4.c
md5.c crypto: md5 - remove unused macros 2020-02-28 08:43:21 +08:00
memneq.c
michael_mic.c
nhpoly1305.c
ofb.c
pcbc.c
pcrypt.c crypto: pcrypt - simplify error handling in pcrypt_create_aead() 2020-03-06 12:28:24 +11:00
poly1305_generic.c
proc.c
ripemd.h
rmd128.c
rmd160.c
rmd256.c
rmd320.c
rng.c
rsa-pkcs1pad.c crypto: rsa-pkcs1pad - simplify error handling in pkcs1pad_create() 2020-03-06 12:28:24 +11:00
rsa.c
rsa_helper.c
rsaprivkey.asn1
rsapubkey.asn1
salsa20_generic.c
scatterwalk.c
scompress.c
seed.c
seqiv.c
serpent_generic.c
sha1_generic.c crypto: lib/sha1 - fold linux/cryptohash.h into crypto/sha.h 2020-05-08 15:32:17 +10:00
sha3_generic.c
sha256_generic.c crypto: lib/sha256 - return void 2020-05-08 15:32:12 +10:00
sha512_generic.c
shash.c crypto: hash - introduce crypto_shash_tfm_digest() 2020-05-08 15:32:12 +10:00
simd.c
skcipher.c
sm3_generic.c
sm4_generic.c
streebog_generic.c
tcrypt.c
tcrypt.h
tea.c
testmgr.c Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2020-04-01 14:47:40 -07:00
testmgr.h
tgr192.c
twofish_common.c
twofish_generic.c
vmac.c
wp512.c
xcbc.c
xor.c
xts.c crypto - Avoid free() namespace collision 2020-05-08 15:30:41 +10:00
xxhash_generic.c
zstd.c