diff mbox series

crypto: algif_hash - Remove bogus SGL free on zero-length error path

Message ID Zbsw1WDUg8mJ5s9e@gondor.apana.org.au
State Accepted
Commit 24c890dd712f6345e382256cae8c97abb0406b70
Headers show
Series crypto: algif_hash - Remove bogus SGL free on zero-length error path | expand

Commit Message

Herbert Xu Feb. 1, 2024, 5:49 a.m. UTC 
On Fri, Jan 26, 2024 at 09:11:39PM +0800, xingwei lee wrote:
> This bug is the same bug that is mentioned in
> https://lore.kernel.org/all/20231211135949.689204-1-syoshida@redhat.com/.
> And I also reproduced it with repro.c in
> https://lore.kernel.org/all/CABOYnLxaHBEaSRaEU+kDsHF8a=9AokO1ZUEVtpeT9ddL8giw3A@mail.gmail.com/
> also see in https://gist.github.com/xrivendell7/b10745f297bd2d12a2e48155920996d2
> and also a simple root cause analysis.

Thanks for the reminder.  I was waiting for an updated patch but
I'll apply the following instead:

---8<---
When a zero-length message is hashed by algif_hash, and an error
is triggered, it tries to free an SG list that was never allocated
in the first place.  Fix this by not freeing the SG list on the
zero-length error path.

Reported-by: Shigeru Yoshida <syoshida@redhat.com>
Reported-by: xingwei lee <xrivendell7@gmail.com>
Fixes: b6d972f68983 ("crypto: af_alg/hash: Fix recvmsg() after sendmsg(MSG_MORE)")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff mbox series

Patch

diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index 82c44d4899b9..e24c829d7a01 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -91,13 +91,13 @@  static int hash_sendmsg(struct socket *sock, struct msghdr *msg,
 		if (!(msg->msg_flags & MSG_MORE)) {
 			err = hash_alloc_result(sk, ctx);
 			if (err)
-				goto unlock_free;
+				goto unlock_free_result;
 			ahash_request_set_crypt(&ctx->req, NULL,
 						ctx->result, 0);
 			err = crypto_wait_req(crypto_ahash_final(&ctx->req),
 					      &ctx->wait);
 			if (err)
-				goto unlock_free;
+				goto unlock_free_result;
 		}
 		goto done_more;
 	}
@@ -170,6 +170,7 @@  static int hash_sendmsg(struct socket *sock, struct msghdr *msg,
 
 unlock_free:
 	af_alg_free_sg(&ctx->sgl);
+unlock_free_result:
 	hash_free_result(sk, ctx);
 	ctx->more = false;
 	goto unlock;