Received: by 2002:a05:6a10:206:0:0:0:0 with SMTP id 6csp2476012pxj; Mon, 10 May 2021 04:02:26 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzHEEeh1YZDnl5Kve3CuZYvVCHim2A0DO52RFvLXBYKHOwUdEuflH3ZstrcmtYIYlfT6wXH X-Received: by 2002:a17:906:d285:: with SMTP id ay5mr24419111ejb.222.1620644546519; Mon, 10 May 2021 04:02:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1620644546; cv=none; d=google.com; s=arc-20160816; b=rGdmLedmSmfY/qPIJjgu3MtPF7eAD7nhO42JWEW2VMPTcUE76dBZs9EAR9RQbyT0cc UlUBTwwHeyXsaQIv37kUk9mwNxngWVy3eMqklilTdBnVv5ewo0fFnCIhNIzSuiv7jGrl SDffXVd3pMTCTtGs9HX7/cZzohKroDBrdu9IwfyD1ph4XvVt3ZIUo2kc52AQEAtKTM77 haYIj5O1ef9GfrBhY183LeDs+4P9odYUjy9QS097/9/BfAgLSgHhd3My4kIwkQEXNupU wVyY29JEppOsbunwj6hLlHDhomclMGauwYLMl7/0JXBuWzWxFapswW3PNaP+Hvo6ewKq PlMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=DHQ89HWHps466wLZFt385hEP3axdeSxPW5g3C6rHdrw=; b=smXzxBIqzeTPA++rfP+MHAtpHgbc8Rv2KBO2/nEjwc7Of83nEUWyySaN1nCynvvcoT S8ekwqAW43a3l0JOnkrgwcAoXUeJ4eL/GnxyL8Cx/OGotR/ZvDWcTF94mkFolPhcuQNR 8OHD0TNtFeP9t7KY7FTSCc9bG3W5yFeLUuiSAUAeStUmgHYgckUGhAzQOsThiULLud+U MGc1/6I9NYnX9VG0hjkgn3MJZQPAtuJ15NaozH1nOrn8rHtIVuOsW6C6BGSNxR8bUDBS Z+jlyZ4ei222q7n0mv8WGhv8BKFEGYWjXtmh5UjhK2mV5r5QfrrBazmzsxdo4566C2ta aXIw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=o69ecXCi; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id f24si13420582ejz.234.2021.05.10.04.02.02; Mon, 10 May 2021 04:02:26 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=o69ecXCi; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233536AbhEJKyx (ORCPT + 99 others); Mon, 10 May 2021 06:54:53 -0400 Received: from mail.kernel.org ([198.145.29.99]:59364 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232509AbhEJKoW (ORCPT ); Mon, 10 May 2021 06:44:22 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 250FE61958; Mon, 10 May 2021 10:33:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1620642797; bh=kNPe/SFWIIckViLfrJ2WNeL1mt+grkRMvXYc8z6Qm3U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=o69ecXCi110gU5gM7zQ3p2YTjp8rUqV6o9uFiFRaeZnO7rvQe3x4iwK0YlM7db9/u zojD/oUwqyyGmhh2gh4BQskFLSDVpZNhVtz3B8kr3HkugM24WiCbthyVPAIPQoxi4D QjcJ9qE006jxb3FdbOqsxOTqQDjlTBfxWqtPCuK4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+12cf5fbfdeba210a89dd@syzkaller.appspotmail.com, Eric Biggers , Ard Biesheuvel , Herbert Xu , Sasha Levin Subject: [PATCH 5.10 056/299] crypto: api - check for ERR pointers in crypto_destroy_tfm() Date: Mon, 10 May 2021 12:17:33 +0200 Message-Id: <20210510102006.731591478@linuxfoundation.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210510102004.821838356@linuxfoundation.org> References: <20210510102004.821838356@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Ard Biesheuvel [ Upstream commit 83681f2bebb34dbb3f03fecd8f570308ab8b7c2c ] Given that crypto_alloc_tfm() may return ERR pointers, and to avoid crashes on obscure error paths where such pointers are presented to crypto_destroy_tfm() (such as [0]), add an ERR_PTR check there before dereferencing the second argument as a struct crypto_tfm pointer. [0] https://lore.kernel.org/linux-crypto/000000000000de949705bc59e0f6@google.com/ Reported-by: syzbot+12cf5fbfdeba210a89dd@syzkaller.appspotmail.com Reviewed-by: Eric Biggers Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin --- crypto/api.c | 2 +- include/crypto/acompress.h | 2 ++ include/crypto/aead.h | 2 ++ include/crypto/akcipher.h | 2 ++ include/crypto/hash.h | 4 ++++ include/crypto/kpp.h | 2 ++ include/crypto/rng.h | 2 ++ include/crypto/skcipher.h | 2 ++ 8 files changed, 17 insertions(+), 1 deletion(-) diff --git a/crypto/api.c b/crypto/api.c index ed08cbd5b9d3..c4eda56cff89 100644 --- a/crypto/api.c +++ b/crypto/api.c @@ -562,7 +562,7 @@ void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm) { struct crypto_alg *alg; - if (unlikely(!mem)) + if (IS_ERR_OR_NULL(mem)) return; alg = tfm->__crt_alg; diff --git a/include/crypto/acompress.h b/include/crypto/acompress.h index fcde59c65a81..cb3d6b1c655d 100644 --- a/include/crypto/acompress.h +++ b/include/crypto/acompress.h @@ -165,6 +165,8 @@ static inline struct crypto_acomp *crypto_acomp_reqtfm(struct acomp_req *req) * crypto_free_acomp() -- free ACOMPRESS tfm handle * * @tfm: ACOMPRESS tfm handle allocated with crypto_alloc_acomp() + * + * If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_acomp(struct crypto_acomp *tfm) { diff --git a/include/crypto/aead.h b/include/crypto/aead.h index c32a6f5664e9..fe956629f34c 100644 --- a/include/crypto/aead.h +++ b/include/crypto/aead.h @@ -185,6 +185,8 @@ static inline struct crypto_tfm *crypto_aead_tfm(struct crypto_aead *tfm) /** * crypto_free_aead() - zeroize and free aead handle * @tfm: cipher handle to be freed + * + * If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_aead(struct crypto_aead *tfm) { diff --git a/include/crypto/akcipher.h b/include/crypto/akcipher.h index 1d3aa252caba..5764b46bd1ec 100644 --- a/include/crypto/akcipher.h +++ b/include/crypto/akcipher.h @@ -174,6 +174,8 @@ static inline struct crypto_akcipher *crypto_akcipher_reqtfm( * crypto_free_akcipher() - free AKCIPHER tfm handle * * @tfm: AKCIPHER tfm handle allocated with crypto_alloc_akcipher() + * + * If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_akcipher(struct crypto_akcipher *tfm) { diff --git a/include/crypto/hash.h b/include/crypto/hash.h index 13f8a6a54ca8..b2bc1e46e86a 100644 --- a/include/crypto/hash.h +++ b/include/crypto/hash.h @@ -281,6 +281,8 @@ static inline struct crypto_tfm *crypto_ahash_tfm(struct crypto_ahash *tfm) /** * crypto_free_ahash() - zeroize and free the ahash handle * @tfm: cipher handle to be freed + * + * If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_ahash(struct crypto_ahash *tfm) { @@ -724,6 +726,8 @@ static inline struct crypto_tfm *crypto_shash_tfm(struct crypto_shash *tfm) /** * crypto_free_shash() - zeroize and free the message digest handle * @tfm: cipher handle to be freed + * + * If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_shash(struct crypto_shash *tfm) { diff --git a/include/crypto/kpp.h b/include/crypto/kpp.h index 88b591215d5c..cccceadc164b 100644 --- a/include/crypto/kpp.h +++ b/include/crypto/kpp.h @@ -154,6 +154,8 @@ static inline void crypto_kpp_set_flags(struct crypto_kpp *tfm, u32 flags) * crypto_free_kpp() - free KPP tfm handle * * @tfm: KPP tfm handle allocated with crypto_alloc_kpp() + * + * If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_kpp(struct crypto_kpp *tfm) { diff --git a/include/crypto/rng.h b/include/crypto/rng.h index 8b4b844b4eef..17bb3673d3c1 100644 --- a/include/crypto/rng.h +++ b/include/crypto/rng.h @@ -111,6 +111,8 @@ static inline struct rng_alg *crypto_rng_alg(struct crypto_rng *tfm) /** * crypto_free_rng() - zeroize and free RNG handle * @tfm: cipher handle to be freed + * + * If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_rng(struct crypto_rng *tfm) { diff --git a/include/crypto/skcipher.h b/include/crypto/skcipher.h index 6a733b171a5d..ef0fc9ed4342 100644 --- a/include/crypto/skcipher.h +++ b/include/crypto/skcipher.h @@ -196,6 +196,8 @@ static inline struct crypto_tfm *crypto_skcipher_tfm( /** * crypto_free_skcipher() - zeroize and free cipher handle * @tfm: cipher handle to be freed + * + * If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_skcipher(struct crypto_skcipher *tfm) { -- 2.30.2