mirror of
https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux
synced 2025-09-19 11:11:35 +10:00
080aa61e37
Syzbot was able to trigger use of uninitialized memory in
af_alg_free_resources.
Bug is caused by missing initialization of rsgl->sgl.need_unpin before
adding to rsgl_list. Then in case of extract_iter_to_sg() failure, rsgl
is left with uninitialized need_unpin which is read during clean up
BUG: KMSAN: uninit-value in af_alg_free_sg crypto/af_alg.c:545 [inline]
BUG: KMSAN: uninit-value in af_alg_free_areq_sgls crypto/af_alg.c:778 [inline]
BUG: KMSAN: uninit-value in af_alg_free_resources+0x3d1/0xf60 crypto/af_alg.c:1117
af_alg_free_sg crypto/af_alg.c:545 [inline]
af_alg_free_areq_sgls crypto/af_alg.c:778 [inline]
af_alg_free_resources+0x3d1/0xf60 crypto/af_alg.c:1117
_skcipher_recvmsg crypto/algif_skcipher.c:144 [inline]
...
Uninit was created at:
slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767
slab_alloc_node mm/slub.c:3470 [inline]
__kmem_cache_alloc_node+0x536/0x8d0 mm/slub.c:3509
__do_kmalloc_node mm/slab_common.c:984 [inline]
__kmalloc+0x121/0x3c0 mm/slab_common.c:998
kmalloc include/linux/slab.h:586 [inline]
sock_kmalloc+0x128/0x1c0 net/core/sock.c:2683
af_alg_alloc_areq+0x41/0x2a0 crypto/af_alg.c:1188
_skcipher_recvmsg crypto/algif_skcipher.c:71 [inline]
Fixes:
|
||
|---|---|---|
| .. | ||
| asymmetric_keys | ||
| async_tx | ||
| 842.c | ||
| acompress.c | ||
| adiantum.c | ||
| aead.c | ||
| aegis128-core.c | ||
| aegis128-neon-inner.c | ||
| aegis128-neon.c | ||
| aegis-neon.h | ||
| aegis.h | ||
| aes_generic.c | ||
| aes_ti.c | ||
| af_alg.c | ||
| ahash.c | ||
| akcipher.c | ||
| algapi.c | ||
| algboss.c | ||
| algif_aead.c | ||
| algif_hash.c | ||
| algif_rng.c | ||
| algif_skcipher.c | ||
| ansi_cprng.c | ||
| anubis.c | ||
| api.c | ||
| arc4.c | ||
| aria_generic.c | ||
| authenc.c | ||
| authencesn.c | ||
| blake2b_generic.c | ||
| blowfish_common.c | ||
| blowfish_generic.c | ||
| camellia_generic.c | ||
| cast5_generic.c | ||
| cast6_generic.c | ||
| cast_common.c | ||
| cbc.c | ||
| ccm.c | ||
| cfb.c | ||
| chacha20poly1305.c | ||
| chacha_generic.c | ||
| cipher.c | ||
| cmac.c | ||
| compress.c | ||
| compress.h | ||
| crc32_generic.c | ||
| crc32c_generic.c | ||
| crc64_rocksoft_generic.c | ||
| crct10dif_common.c | ||
| crct10dif_generic.c | ||
| cryptd.c | ||
| crypto_engine.c | ||
| crypto_null.c | ||
| crypto_user_base.c | ||
| crypto_user_stat.c | ||
| ctr.c | ||
| cts.c | ||
| curve25519-generic.c | ||
| deflate.c | ||
| des_generic.c | ||
| dh_helper.c | ||
| dh.c | ||
| drbg.c | ||
| ecb.c | ||
| ecc_curve_defs.h | ||
| ecc.c | ||
| ecdh_helper.c | ||
| ecdh.c | ||
| ecdsa.c | ||
| ecdsasignature.asn1 | ||
| echainiv.c | ||
| ecrdsa_defs.h | ||
| ecrdsa_params.asn1 | ||
| ecrdsa_pub_key.asn1 | ||
| ecrdsa.c | ||
| essiv.c | ||
| fcrypt.c | ||
| fips.c | ||
| gcm.c | ||
| geniv.c | ||
| ghash-generic.c | ||
| hash_info.c | ||
| hash.h | ||
| hctr2.c | ||
| hmac.c | ||
| internal.h | ||
| jitterentropy-kcapi.c | ||
| jitterentropy-testing.c | ||
| jitterentropy.c | ||
| jitterentropy.h | ||
| Kconfig | ||
| kdf_sp800108.c | ||
| keywrap.c | ||
| khazad.c | ||
| kpp.c | ||
| lrw.c | ||
| lz4.c | ||
| lz4hc.c | ||
| lzo-rle.c | ||
| lzo.c | ||
| Makefile | ||
| md4.c | ||
| md5.c | ||
| michael_mic.c | ||
| nhpoly1305.c | ||
| ofb.c | ||
| pcbc.c | ||
| pcrypt.c | ||
| poly1305_generic.c | ||
| polyval-generic.c | ||
| proc.c | ||
| ripemd.h | ||
| rmd160.c | ||
| rng.c | ||
| rsa_helper.c | ||
| rsa-pkcs1pad.c | ||
| rsa.c | ||
| rsaprivkey.asn1 | ||
| rsapubkey.asn1 | ||
| scatterwalk.c | ||
| scompress.c | ||
| seed.c | ||
| seqiv.c | ||
| serpent_generic.c | ||
| sha1_generic.c | ||
| sha3_generic.c | ||
| sha256_generic.c | ||
| sha512_generic.c | ||
| shash.c | ||
| sig.c | ||
| simd.c | ||
| skcipher.c | ||
| sm2.c | ||
| sm2signature.asn1 | ||
| sm3_generic.c | ||
| sm3.c | ||
| sm4_generic.c | ||
| sm4.c | ||
| streebog_generic.c | ||
| tcrypt.c | ||
| tcrypt.h | ||
| tea.c | ||
| testmgr.c | ||
| testmgr.h | ||
| twofish_common.c | ||
| twofish_generic.c | ||
| vmac.c | ||
| wp512.c | ||
| xcbc.c | ||
| xctr.c | ||
| xor.c | ||
| xts.c | ||
| xxhash_generic.c | ||
| zstd.c | ||