Enzo Matsumiya
0809fb86ad
smb: client: fix UAF in async decryption
[ Upstream commit b0abcd65ec545701b8793e12bc27dc98042b151a ]
Doing an async decryption (large read) crashes with a
slab-use-after-free way down in the crypto API.
Reproducer:
# mount.cifs -o ...,seal,esize=1 //srv/share /mnt
# dd if=/mnt/largefile of=/dev/null
...
[ 194.196391] ==================================================================
[ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110
[ 194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899
[ 194.197707]
[ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43
[ 194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014
[ 194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs]
[ 194.200032] Call Trace:
[ 194.200191] <TASK>
[ 194.200327] dump_stack_lvl+0x4e/0x70
[ 194.200558] ? gf128mul_4k_lle+0xc1/0x110
[ 194.200809] print_report+0x174/0x505
[ 194.201040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 194.201352] ? srso_return_thunk+0x5/0x5f
[ 194.201604] ? __virt_addr_valid+0xdf/0x1c0
[ 194.201868] ? gf128mul_4k_lle+0xc1/0x110
[ 194.202128] kasan_report+0xc8/0x150
[ 194.202361] ? gf128mul_4k_lle+0xc1/0x110
[ 194.202616] gf128mul_4k_lle+0xc1/0x110
[ 194.202863] ghash_update+0x184/0x210
[ 194.203103] shash_ahash_update+0x184/0x2a0
[ 194.203377] ? __pfx_shash_ahash_update+0x10/0x10
[ 194.203651] ? srso_return_thunk+0x5/0x5f
[ 194.203877] ? crypto_gcm_init_common+0x1ba/0x340
[ 194.204142] gcm_hash_assoc_remain_continue+0x10a/0x140
[ 194.204434] crypt_message+0xec1/0x10a0 [cifs]
[ 194.206489] ? __pfx_crypt_message+0x10/0x10 [cifs]
[ 194.208507] ? srso_return_thunk+0x5/0x5f
[ 194.209205] ? srso_return_thunk+0x5/0x5f
[ 194.209925] ? srso_return_thunk+0x5/0x5f
[ 194.210443] ? srso_return_thunk+0x5/0x5f
[ 194.211037] decrypt_raw_data+0x15f/0x250 [cifs]
[ 194.212906] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]
[ 194.214670] ? srso_return_thunk+0x5/0x5f
[ 194.215193] smb2_decrypt_offload+0x12a/0x6c0 [cifs]
This is because TFM is being used in parallel.
Fix this by allocating a new AEAD TFM for async decryption, but keep
the existing one for synchronous READ cases (similar to what is done
in smb3_calc_signature()).
Also remove the calls to aead_request_set_callback() and
crypto_wait_req() since it's always going to be a synchronous operation.
Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-10-17 15:24:21 +02:00
..
2024-06-16 13:47:37 +02:00
2023-08-29 20:21:42 -07:00
2023-08-29 20:21:42 -07:00
2024-08-29 17:33:32 +02:00
2023-08-28 11:39:14 -07:00
2023-08-29 20:21:42 -07:00
2023-08-29 20:21:42 -07:00
2024-10-10 11:58:06 +02:00
2024-10-10 11:57:57 +02:00
2024-10-10 11:57:59 +02:00
2023-08-28 09:31:32 -07:00
2023-07-13 10:28:05 +02:00
2024-08-19 06:04:25 +02:00
2024-10-04 16:29:48 +02:00
2024-01-20 11:51:37 +01:00
2023-08-28 10:17:14 -07:00
2024-06-12 11:11:38 +02:00
2024-10-04 16:29:48 +02:00
2024-03-06 14:48:41 +00:00
2023-08-29 20:21:42 -07:00
2024-10-04 16:29:00 +02:00
2024-10-10 11:57:52 +02:00
2023-08-29 17:45:22 -04:00
2024-08-03 08:54:15 +02:00
2024-10-17 15:24:16 +02:00
2024-10-04 16:29:54 +02:00
2024-04-03 15:28:20 +02:00
2023-08-29 20:21:42 -07:00
2024-09-12 11:11:27 +02:00
2024-09-12 11:11:26 +02:00
2024-10-17 15:24:08 +02:00
2024-08-03 08:54:15 +02:00
2024-08-03 08:53:21 +02:00
2024-08-03 08:54:22 +02:00
2023-08-29 20:21:42 -07:00
2024-02-23 09:25:16 +01:00
2024-10-10 11:57:39 +02:00
2024-04-13 13:07:34 +02:00
2024-10-10 11:57:50 +02:00
2024-07-11 12:49:09 +02:00
2024-10-10 11:57:34 +02:00
2024-08-29 17:33:33 +02:00
2024-08-19 06:04:23 +02:00
2023-08-29 20:21:42 -07:00
2023-09-18 12:03:46 -07:00
2024-10-04 16:29:56 +02:00
2024-10-10 11:57:53 +02:00
2024-10-04 16:29:22 +02:00
2023-08-31 12:07:34 -05:00
2024-09-08 07:54:44 +02:00
2023-08-29 20:21:42 -07:00
2024-10-17 15:24:14 +02:00
2024-10-10 11:57:51 +02:00
2023-08-29 20:21:42 -07:00
2024-06-12 11:11:30 +02:00
2024-07-11 12:49:08 +02:00
2024-10-10 11:57:44 +02:00
2024-10-10 11:57:27 +02:00
2024-04-13 13:07:31 +02:00
2023-08-29 20:21:42 -07:00
2023-08-29 20:21:42 -07:00
2024-08-29 17:33:33 +02:00
2023-07-24 10:30:04 +02:00
2024-08-19 06:04:26 +02:00
2024-08-19 06:04:25 +02:00
2024-10-17 15:24:21 +02:00
2024-09-12 11:11:39 +02:00
2024-04-27 17:11:41 +02:00
2024-04-13 13:07:34 +02:00
2024-09-12 11:11:27 +02:00
2024-10-10 11:58:09 +02:00
2024-09-12 11:11:30 +02:00
2023-08-29 20:21:42 -07:00
2024-10-17 15:24:07 +02:00
2024-05-17 12:02:13 +02:00
2024-06-16 13:47:33 +02:00
2024-08-14 13:59:03 +02:00
2024-02-23 09:25:13 +01:00
2024-04-03 15:28:44 +02:00
2023-08-28 10:17:14 -07:00
2023-08-11 09:04:57 +02:00
2024-08-29 17:33:33 +02:00
2024-09-12 11:11:29 +02:00
2024-08-19 06:04:30 +02:00
2024-08-29 17:33:27 +02:00
2024-08-19 06:04:29 +02:00
2024-10-10 11:57:18 +02:00
2024-07-25 09:50:54 +02:00
2023-06-28 10:28:11 -07:00
2023-08-18 10:12:11 -07:00
2023-07-11 11:41:34 +02:00
2024-06-12 11:11:30 +02:00
2024-10-10 11:57:49 +02:00
2024-10-04 16:29:56 +02:00
2024-08-19 06:04:28 +02:00
2023-08-08 19:36:51 +02:00
2024-10-10 11:58:00 +02:00
2023-10-12 18:53:36 +03:00
2023-08-21 13:46:25 -07:00
2024-06-27 13:49:00 +02:00
2023-08-14 18:48:02 +02:00
2024-10-04 16:29:56 +02:00
2023-08-29 20:21:42 -07:00
2024-01-31 16:18:54 -08:00
2023-08-29 20:21:42 -07:00
2023-08-23 14:17:43 -07:00
2023-08-19 12:12:12 +02:00
2024-01-05 15:19:40 +01:00
2024-07-27 11:34:10 +02:00
2023-08-02 09:13:09 -06:00
2024-10-04 16:29:48 +02:00
2024-10-04 16:28:51 +02:00
2023-07-13 10:28:04 +02:00
2024-07-05 09:34:04 +02:00
2024-04-10 16:35:57 +02:00
2023-07-13 10:28:04 +02:00
2023-08-15 08:32:45 +02:00
2023-08-06 15:08:35 +02:00
2024-03-26 18:19:17 -04:00
2023-08-29 14:25:26 -07:00
2023-07-13 10:28:04 +02:00
2023-12-03 07:33:03 +01:00
2024-08-19 06:04:25 +02:00
2024-07-18 13:21:22 +02:00
2024-09-12 11:11:38 +02:00