63 lines
2.6 KiB
Diff
63 lines
2.6 KiB
Diff
From b404b859e714b89a20c22818d2a2606290c68266 Mon Sep 17 00:00:00 2001
|
|
From: Ilya Dryomov <idryomov@redhat.com>
|
|
Date: Thu, 4 Jun 2026 13:24:44 +0200
|
|
Subject: [PATCH] crypto: krb5 - filter out async aead implementations at alloc
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-182254
|
|
Upstream Status: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
|
|
|
|
commit 6c9dddeb582fde005360f4fe02c760d45ca05fb5
|
|
Author: Michael Bommarito <michael.bommarito@gmail.com>
|
|
Date: Sun May 10 19:24:55 2026 -0400
|
|
|
|
crypto: krb5 - filter out async aead implementations at alloc
|
|
|
|
krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and
|
|
rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL
|
|
completion callback and treat any negative return from
|
|
crypto_aead_{encrypt,decrypt}() as terminal, falling through to
|
|
kfree_sensitive(buffer). When the encrypt_name resolves to an
|
|
async AEAD instance the request returns -EINPROGRESS, the buffer
|
|
is freed while the backend's worker still holds a pointer, and the
|
|
worker dereferences the freed slab on completion.
|
|
|
|
KASAN report under UML+SLUB with a synthetic async aead backend
|
|
bound to krb5->encrypt_name:
|
|
|
|
BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7
|
|
|
|
The helpers were written synchronously, so filter the async
|
|
instances out at allocation time instead of plumbing
|
|
crypto_wait_req() through every call site.
|
|
|
|
Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and
|
|
net/ceph/crypto.c on systems with an async AEAD provider bound to
|
|
the krb5 enctype name.
|
|
|
|
Fixes: 00244da40f78 ("crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions")
|
|
Fixes: 6c3c0e86c2ac ("crypto/krb5: Implement the AES enctypes from rfc8009")
|
|
Cc: stable@vger.kernel.org
|
|
Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
Assisted-by: Claude:claude-opus-4-7
|
|
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
|
|
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
|
|
Signed-off-by: Ilya Dryomov <idryomov@redhat.com>
|
|
|
|
diff --git a/crypto/krb5/krb5_api.c b/crypto/krb5/krb5_api.c
|
|
index 23026d4206c8..2b20284fa0ab 100644
|
|
--- a/crypto/krb5/krb5_api.c
|
|
+++ b/crypto/krb5/krb5_api.c
|
|
@@ -165,7 +165,7 @@ struct crypto_aead *krb5_prepare_encryption(const struct krb5_enctype *krb5,
|
|
struct crypto_aead *ci = NULL;
|
|
int ret = -ENOMEM;
|
|
|
|
- ci = crypto_alloc_aead(krb5->encrypt_name, 0, 0);
|
|
+ ci = crypto_alloc_aead(krb5->encrypt_name, 0, CRYPTO_ALG_ASYNC);
|
|
if (IS_ERR(ci)) {
|
|
ret = PTR_ERR(ci);
|
|
if (ret == -ENOENT)
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|