2012-06-28 15:26:12

by Milan Broz

Subject: [PATCH] crypto: aesni-intel - fix wrong kfree pointer

kfree(new_key_mem) in rfc4106_set_key() should be called on malloced pointer,
not on aligned one, otherwise it can cause invalid pointer on free.

(Seen at least once when running tcrypt tests with debug kernel.)

Signed-off-by: Milan Broz <[email protected]>
---
arch/x86/crypto/aesni-intel_glue.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
index ac7f5cd..c9bac53 100644
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -613,7 +613,7 @@ static int rfc4106_set_key(struct crypto_aead *parent, const u8 *key,
struct crypto_aead *cryptd_child = cryptd_aead_child(ctx->cryptd_tfm);
struct aesni_rfc4106_gcm_ctx *child_ctx =
aesni_rfc4106_gcm_ctx_get(cryptd_child);
- u8 *new_key_mem = NULL;
+ u8 *new_key_align, *new_key_mem = NULL;

if (key_len < 4) {
crypto_tfm_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
@@ -637,9 +637,9 @@ static int rfc4106_set_key(struct crypto_aead *parent, const u8 *key,
if (!new_key_mem)
return -ENOMEM;

- new_key_mem = PTR_ALIGN(new_key_mem, AESNI_ALIGN);
- memcpy(new_key_mem, key, key_len);
- key = new_key_mem;
+ new_key_align = PTR_ALIGN(new_key_mem, AESNI_ALIGN);
+ memcpy(new_key_align, key, key_len);
+ key = new_key_align;
}

if (!irq_fpu_usable())
--
1.7.10

2012-07-11 03:24:47

by Herbert Xu

Subject: Re: [PATCH] crypto: aesni-intel - fix wrong kfree pointer

On Thu, Jun 28, 2012 at 05:26:02PM +0200, Milan Broz wrote:
> kfree(new_key_mem) in rfc4106_set_key() should be called on malloced pointer,
> not on aligned one, otherwise it can cause invalid pointer on free.
>
> (Seen at least once when running tcrypt tests with debug kernel.)
>
> Signed-off-by: Milan Broz <[email protected]>

Good catch. Patch applied.
--
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt