releases/4.19.45/crypto-arm-aes-neonbs-don-t-access-already-freed-walk.iv.patch

   1 From 767f015ea0b7ab9d60432ff6cd06b664fd71f50f Mon Sep 17 00:00:00 2001
   2 From: Eric Biggers <ebiggers@google.com>
   3 Date: Tue, 9 Apr 2019 23:46:31 -0700
   4 Subject: crypto: arm/aes-neonbs - don't access already-freed walk.iv
   5
   6 From: Eric Biggers <ebiggers@google.com>
   7
   8 commit 767f015ea0b7ab9d60432ff6cd06b664fd71f50f upstream.
   9
  10 If the user-provided IV needs to be aligned to the algorithm's
  11 alignmask, then skcipher_walk_virt() copies the IV into a new aligned
  12 buffer walk.iv.  But skcipher_walk_virt() can fail afterwards, and then
  13 if the caller unconditionally accesses walk.iv, it's a use-after-free.
  14
  15 arm32 xts-aes-neonbs doesn't set an alignmask, so currently it isn't
  16 affected by this despite unconditionally accessing walk.iv.  However
  17 this is more subtle than desired, and it was actually broken prior to
  18 the alignmask being removed by commit cc477bf64573 ("crypto: arm/aes -
  19 replace bit-sliced OpenSSL NEON code").  Thus, update xts-aes-neonbs to
  20 start checking the return value of skcipher_walk_virt().
  21
  22 Fixes: e4e7f10bfc40 ("ARM: add support for bit sliced AES using NEON instructions")
  23 Cc: <stable@vger.kernel.org> # v3.13+
  24 Signed-off-by: Eric Biggers <ebiggers@google.com>
  25 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  26 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  27
  28 ---
  29  arch/arm/crypto/aes-neonbs-glue.c |    2 ++
  30  1 file changed, 2 insertions(+)
  31
  32 --- a/arch/arm/crypto/aes-neonbs-glue.c
  33 +++ b/arch/arm/crypto/aes-neonbs-glue.c
  34 @@ -278,6 +278,8 @@ static int __xts_crypt(struct skcipher_r
  35         int err;
  36
  37         err = skcipher_walk_virt(&walk, req, true);
  38 +       if (err)
  39 +               return err;
  40
  41         crypto_cipher_encrypt_one(ctx->tweak_tfm, walk.iv, walk.iv);
  42