kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/crypto
History
Dawei Feng c80360b4e8 crypto: amlogic - avoid double cleanup in meson_crypto_probe() 
commit 6d827ade51 upstream.

When meson_allocate_chanlist() fails after a partial allocation, it already
unwinds the allocated chanlist state through its local error path.
meson_crypto_probe() then jump to error_flow and calls
meson_free_chanlist() again, causing the same per-flow resources to be torn
down twice. In the reproduced failure path, the second teardown
re-entered crypto_engine_exit() on an already destroyed worker and KASAN
reported a slab-use-after-free in kthread_destroy_worker().

Prevent double-free by handling partial allocation failures locally within
meson_allocate_chanlist() and skipping the outer cleanup path.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available.

The bug was reproduced in a QEMU x86_64 guest booted with KASAN on v7.1,
using the reproducer under tools/testing/meson_crypto_probe. The reproducer
forces the second dma_alloc_attrs() call in the gxl-crypto probe path to
return NULL, making meson_allocate_chanlist() fail after partial
initialization. On the unpatched kernel this reliably triggered a
slab-use-after-free. With this fix applied, the same reproducer no longer
emits any KASAN report and the probe fails cleanly with -ENOMEM.

    ==================================================================
    BUG: KASAN: slab-use-after-free in kthread_destroy_worker+0xb2/0xd0
    Read of size 8 at addr ff1100010c057a68 by task insmod/265

    CPU: 1 UID: 0 PID: 265 Comm: insmod Tainted: G           O        7.1.0-rc2-00376-g810af9adc907-dirty #10 PREEMPT(lazy)
    Tainted: [O]=OOT_MODULE
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
    Call Trace:
     <TASK>
     dump_stack_lvl+0x68/0xa0
     print_report+0xcb/0x5e0
     ? __virt_addr_valid+0x21d/0x3f0
     ? kthread_destroy_worker+0xb2/0xd0
     ? kthread_destroy_worker+0xb2/0xd0
     kasan_report+0xca/0x100
     ? kthread_destroy_worker+0xb2/0xd0
     kthread_destroy_worker+0xb2/0xd0
     meson_crypto_probe+0x4d0/0xc10 [amlogic_gxl_crypto]
     platform_probe+0x99/0x140
     really_probe+0x1c6/0x6a0
     ? __pfx___device_attach_driver+0x10/0x10
     __driver_probe_device+0x248/0x310
     ? acpi_driver_match_device+0xb0/0x100
     driver_probe_device+0x48/0x210
     ? __pfx___device_attach_driver+0x10/0x10
     __device_attach_driver+0x160/0x320
     bus_for_each_drv+0x104/0x190
     ? __pfx_bus_for_each_drv+0x10/0x10
     ? _raw_spin_unlock_irqrestore+0x2c/0x50
     __device_attach+0x19d/0x3b0
     ? __pfx___device_attach+0x10/0x10
     ? do_raw_spin_unlock+0x53/0x220
     device_initial_probe+0x78/0xa0
     bus_probe_device+0x5b/0x130
     device_add+0xcfd/0x1430
     ? __pfx_device_add+0x10/0x10
     ? insert_resource+0x34/0x50
     ? lock_release+0xc9/0x290
     platform_device_add+0x24e/0x590
     ? __pfx_meson_crypto_probe_repro_init+0x10/0x10 [meson_crypto_probe_repro]
     meson_crypto_probe_repro_init+0x330/0xff0 [meson_crypto_probe_repro]
     do_one_initcall+0xc0/0x450
     ? __pfx_do_one_initcall+0x10/0x10
     ? _raw_spin_unlock_irqrestore+0x2c/0x50
     ? __create_object+0x59/0x80
     ? kasan_unpoison+0x27/0x60
     do_init_module+0x27b/0x7d0
     ? __pfx_do_init_module+0x10/0x10
     ? kasan_quarantine_put+0x84/0x1d0
     ? kfree+0x32c/0x510
     ? load_module+0x561e/0x5ff0
     load_module+0x54fe/0x5ff0
     ? __pfx_load_module+0x10/0x10
     ? security_file_permission+0x20/0x40
     ? kernel_read_file+0x23d/0x6e0
     ? mmap_region+0x235/0x4a0
     ? __pfx_kernel_read_file+0x10/0x10
     ? __file_has_perm+0x2c0/0x3e0
     init_module_from_file+0x158/0x180
     ? __pfx_init_module_from_file+0x10/0x10
     ? __lock_acquire+0x45a/0x1ba0
     ? idempotent_init_module+0x315/0x610
     ? lock_release+0xc9/0x290
     ? lockdep_init_map_type+0x4b/0x220
     ? do_raw_spin_unlock+0x53/0x220
     idempotent_init_module+0x330/0x610
     ? __pfx_idempotent_init_module+0x10/0x10
     ? __pfx_cred_has_capability.isra.0+0x10/0x10
     ? ksys_mmap_pgoff+0x385/0x520
     __x64_sys_finit_module+0xbe/0x120
     do_syscall_64+0x115/0x690
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7f7d6d31690d
    Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f3 b4 0f 00 f7 d8 >
    RSP: 002b:00007fffc027ac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
    RAX: ffffffffffffffda RBX: 000055f7b81967c0 RCX: 00007f7d6d31690d
    RDX: 0000000000000000 RSI: 000055f79a0d6cd2 RDI: 0000000000000003
    RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000003 R11: 0000000000000246 R12: 000055f79a0d6cd2
    R13: 000055f7b8196790 R14: 000055f79a0d5888 R15: 000055f7b81968e0
     </TASK>

Fixes: 48fe583fe5 ("crypto: amlogic - Add crypto accelerator for amlogic GXL")
Cc: stable@vger.kernel.org
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-07-24 15:51:21 +02:00
..
allwinner crypto: sun8i-ce - move fallback ahash_request to the end of the struct 2025-06-27 11:05:10 +01:00
amcc crypto: crypto4xx - Call dma_unmap_page when done 2023-03-10 09:39:17 +01:00
amlogic crypto: amlogic - avoid double cleanup in meson_crypto_probe() 2026-07-24 15:51:21 +02:00
axis crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
bcm crypto: bcm - add error check in the ahash_hmac_init function 2024-12-14 19:50:45 +01:00
caam crypto: caam - guard HMAC key hex dumps in hash_digest_key 2026-06-19 13:33:42 +02:00
cavium crypto: cavium - fix dma_free_coherent() size 2026-03-04 07:19:24 -05:00
ccp crypto: ccp - copy IV using skcipher ivsize 2026-06-01 17:35:37 +02:00
ccree crypto: ccree - fix a memory leak in cc_mac_digest() 2026-06-01 17:35:17 +02:00
chelsio crypto: chelsio/chcr - Remove useless MODULE_VERSION 2021-04-22 17:31:31 +10:00
gemini crypto: gemini - call finalize with bh disabled 2022-04-08 14:23:08 +02:00
hisilicon crypto: hisilicon - Fix dma_unmap_single() direction 2026-06-01 17:35:17 +02:00
inside-secure crypto: inside-secure - Fix dma_unmap_sg() nents value 2025-08-28 16:24:09 +02:00
keembay crypto: keembay - Fix dma_unmap_sg() nents value 2025-08-28 16:24:10 +02:00
marvell crypto: octeontx - fix dma_free_coherent() size 2026-03-04 07:19:24 -05:00
nx crypto: nx - Fix uninitialised hv_nxc on error 2025-04-10 14:32:01 +02:00
qat crypto: qat - remove unused character device and IOCTLs 2026-07-04 13:39:41 +02:00
qce crypto: qce - unregister previously registered algos in error path 2025-03-13 12:50:31 +01:00
rockchip crypto: rockchip - Fix dma_unmap_sg() nents value 2025-10-29 14:03:07 +01:00
stm32 crypto: stm32/crc32 - fix parsing list of devices 2024-02-23 08:54:39 +01:00
ux500 crypto: ux500 - Fix error return code in hash_hw_final() 2021-05-14 19:07:58 +08:00
virtio crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req 2026-02-19 16:21:45 +01:00
vmx crypto: vmx - add missing dependencies 2022-04-08 14:23:08 +02:00
xilinx crypto: xilinx - call finalize with bh disabled 2024-03-26 18:21:27 -04:00
atmel-aes-regs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
atmel-aes.c crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup 2026-06-01 17:35:17 +02:00
atmel-authenc.h crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
atmel-ecc.c crypto: atmel-ecc - Release client on allocation failure 2026-06-01 17:35:17 +02:00
atmel-i2c.c crypto: atmel - use the correct print format 2021-04-16 21:16:33 +10:00
atmel-i2c.h crypto: atmel - Fix -Wunused-const-variable warning 2019-08-30 18:05:31 +10:00
atmel-sha-regs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
atmel-sha.c crypto: atmel - use the correct print format 2021-04-16 21:16:33 +10:00
atmel-sha204a.c crypto: atmel-sha204a - Set hwrng quality to lowest possible 2025-05-02 07:44:39 +02:00
atmel-tdes-regs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
atmel-tdes.c crypto: atmel-tdes - fix DMA sync direction 2026-06-01 17:35:18 +02:00
exynos-rng.c crypto: exynos - use devm_platform_ioremap_resource() to simplify code 2019-08-09 15:11:59 +10:00
geode-aes.c crypto: geode - use DEFINE_SPINLOCK() for spinlock 2021-04-16 21:16:31 +10:00
geode-aes.h crypto: geode-aes - convert to skcipher API and make thread-safe 2019-10-23 19:46:56 +11:00
hifn_795x.c crypto: drivers - use semicolons rather than commas to separate statements 2020-10-02 18:02:15 +10:00
img-hash.c crypto: img-hash - Fix dma_unmap_sg() nents value 2025-08-28 16:24:10 +02:00
ixp4xx_crypto.c crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto() 2025-03-13 12:50:01 +01:00
Kconfig crypto: sa2ul - Select CRYPTO_DES 2023-05-11 23:00:27 +09:00
Makefile crypto: sl3516 - Add sl3516 crypto engine 2021-06-11 15:03:29 +08:00
mxs-dcp.c crypto: mxs-dcp - Fix scatterlist processing 2022-04-08 14:23:05 +02:00
n2_asm.S License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
n2_core.c crypto: n2 - add missing hash statesize 2023-01-12 11:58:58 +01:00
n2_core.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
omap-aes-gcm.c crypto: omap-aes - avoid spamming console with self tests 2020-06-04 22:03:39 +10:00
omap-aes.c crypto: omap-aes - Fix broken pm_runtime_and_get() usage 2022-01-27 11:05:06 +01:00
omap-aes.h crypto: omap-aes - permit asynchronous skcipher as fallback 2020-07-16 21:49:02 +10:00
omap-crypto.c crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly 2026-02-19 16:21:43 +01:00
omap-crypto.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
omap-des.c crypto: omap - Fix inconsistent locking of device lists 2021-08-21 15:44:53 +08:00
omap-sham.c crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() 2022-12-31 13:14:26 +01:00
padlock-aes.c crypto: algapi - Remove skbuff.h inclusion 2020-08-20 14:04:28 +10:00
padlock-sha.c crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
qcom-rng.c crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ 2022-05-25 09:57:28 +02:00
s5p-sss.c crypto: s5p-sss - Add error handling in s5p_aes_probe() 2021-11-18 19:15:53 +01:00
sa2ul.c crypto: sa2ul - Fix AEAD fallback algorithm names 2026-06-01 17:35:37 +02:00
sa2ul.h crypto: sa2ul - Add support for AM64 2021-04-22 17:31:30 +10:00
sahara.c crypto: sahara - do not resize req->src when doing hash operations 2024-01-25 14:52:35 -08:00
talitos.c crypto: talitos - Fix ctr(aes) on SEC1 2021-01-29 15:57:59 +11:00
talitos.h crypto: talitos - Work around SEC6 ERRATA (AES-CTR mode data size error) 2021-01-29 15:57:58 +11:00