]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
smb: client: fix use-after-free in crypt_message when using async crypto
authorWang Zhaolong <wangzhaolong@huaweicloud.com>
Sat, 5 Jul 2025 02:51:18 +0000 (10:51 +0800)
committerSteve French <stfrench@microsoft.com>
Sun, 13 Jul 2025 22:16:29 +0000 (17:16 -0500)
The CVE-2024-50047 fix removed asynchronous crypto handling from
crypt_message(), assuming all crypto operations are synchronous.
However, when hardware crypto accelerators are used, this can cause
use-after-free crashes:

  crypt_message()
    // Allocate the creq buffer containing the req
    creq = smb2_get_aead_req(..., &req);

    // Async encryption returns -EINPROGRESS immediately
    rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);

    // Free creq while async operation is still in progress
    kvfree_sensitive(creq, ...);

Hardware crypto modules often implement async AEAD operations for
performance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS,
the operation completes asynchronously. Without crypto_wait_req(),
the function immediately frees the request buffer, leading to crashes
when the driver later accesses the freed memory.

This results in a use-after-free condition when the hardware crypto
driver later accesses the freed request structure, leading to kernel
crashes with NULL pointer dereferences.

The issue occurs because crypto_alloc_aead() with mask=0 doesn't
guarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in
the mask, async implementations can be selected.

Fix by restoring the async crypto handling:
- DECLARE_CRYPTO_WAIT(wait) for completion tracking
- aead_request_set_callback() for async completion notification
- crypto_wait_req() to wait for operation completion

This ensures the request buffer isn't freed until the crypto operation
completes, whether synchronous or asynchronous, while preserving the
CVE-2024-50047 fix.

Fixes: b0abcd65ec54 ("smb: client: fix UAF in async decryption")
Link: https://lore.kernel.org/all/8b784a13-87b0-4131-9ff9-7a8993538749@huaweicloud.com/
Cc: stable@vger.kernel.org
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Wang Zhaolong <wangzhaolong@huaweicloud.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/client/smb2ops.c

index 1468c16ea9b80ce1678bf151c42ecac93026b645..cb659256d219fcc0bff5218a7588b384b12b16b0 100644 (file)
@@ -4316,6 +4316,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
        u8 key[SMB3_ENC_DEC_KEY_SIZE];
        struct aead_request *req;
        u8 *iv;
+       DECLARE_CRYPTO_WAIT(wait);
        unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
        void *creq;
        size_t sensitive_size;
@@ -4366,7 +4367,11 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
        aead_request_set_crypt(req, sg, sg, crypt_len, iv);
        aead_request_set_ad(req, assoc_data_len);
 
-       rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);
+       aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+                                 crypto_req_done, &wait);
+
+       rc = crypto_wait_req(enc ? crypto_aead_encrypt(req)
+                               : crypto_aead_decrypt(req), &wait);
 
        if (!rc && enc)
                memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);