From: Ard Biesheuvel Subject: [PATCH] crypto: skcipher - fix crash in virtual walk Date: Tue, 13 Dec 2016 13:34:02 +0000 Message-ID: <1481636042-27347-1-git-send-email-ard.biesheuvel@linaro.org> Cc: herbert@gondor.apana.org.au, Ard Biesheuvel To: linux-crypto@vger.kernel.org Return-path: Received: from mail-wm0-f54.google.com ([74.125.82.54]:35809 "EHLO mail-wm0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932656AbcLMNeK (ORCPT ); Tue, 13 Dec 2016 08:34:10 -0500 Received: by mail-wm0-f54.google.com with SMTP id a197so109970254wmd.0 for ; Tue, 13 Dec 2016 05:34:10 -0800 (PST) Sender: linux-crypto-owner@vger.kernel.org List-ID: The new skcipher walk API may crash in the following way. (Interestingly, the tcrypt boot time tests seem unaffected, while an explicit test using the module triggers it) Unable to handle kernel NULL pointer dereference at virtual address 00000000 ... [] __memcpy+0x84/0x180 [] skcipher_walk_done+0x328/0x340 [] ctr_encrypt+0x84/0x100 [] simd_skcipher_encrypt+0x88/0x98 [] crypto_rfc3686_crypt+0x8c/0x98 [] test_skcipher_speed+0x518/0x820 [tcrypt] [] do_test+0x1408/0x3b70 [tcrypt] [] tcrypt_mod_init+0x50/0x1000 [tcrypt] [] do_one_initcall+0x44/0x138 [] do_init_module+0x68/0x1e0 [] load_module+0x1fd0/0x2458 [] SyS_finit_module+0xe0/0xf0 [] el0_svc_naked+0x24/0x28 This is due to the fact that skcipher_done_slow() may be entered with walk->buffer unset. Since skcipher_walk_done() already deals with the case where walk->buffer == walk->page, it appears to be the intention that walk->buffer point to walk->page after skcipher_next_slow(), so ensure that is the case. Signed-off-by: Ard Biesheuvel --- crypto/skcipher.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/crypto/skcipher.c b/crypto/skcipher.c index aca07c643d41..0e1e6c35188e 100644 --- a/crypto/skcipher.c +++ b/crypto/skcipher.c @@ -226,7 +226,9 @@ static int skcipher_next_slow(struct skcipher_walk *walk, unsigned int bsize) void *v; if (!phys) { - buffer = walk->buffer ?: walk->page; + if (!walk->buffer) + walk->buffer = walk->page; + buffer = walk->buffer; if (buffer) goto ok; } -- 2.7.4