1. Patchew
  2. linux
  3. View series

[PATCH] crypto: essiv: avoid request access after subrequest

Jiale Yao posted 1 patch 3 days, 9 hours ago 
crypto/essiv.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
[PATCH] crypto: essiv: avoid request access after subrequest
Posted by Jiale Yao 3 days, 9 hours ago 
essiv_aead_crypt() reads rctx->assoc after submitting the child AEAD
request. An asynchronous completion can run essiv_aead_done(), free the
association buffer, and complete the outer request before the submission
call returns. The later request-context access can therefore use freed
memory and trigger a second free.

Snapshot the association buffer pointer before submitting the child
request and use the local value for synchronous cleanup.

Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 crypto/essiv.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/crypto/essiv.c b/crypto/essiv.c
index a47a3eab6935..5aea4584d5cb 100644
--- a/crypto/essiv.c
+++ b/crypto/essiv.c
@@ -189,6 +189,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
 	int ivsize = crypto_aead_ivsize(tfm);
 	int ssize = req->assoclen - ivsize;
 	struct scatterlist *src = req->src;
+	void *assoc;
 	int err;
 
 	if (ssize < 0)
@@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
 				  essiv_aead_done, req);
 	aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv);
 
+	assoc = rctx->assoc;
 	err = enc ? crypto_aead_encrypt(subreq) :
 		    crypto_aead_decrypt(subreq);
 
-	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
-		kfree(rctx->assoc);
+	if (assoc && err != -EINPROGRESS && err != -EBUSY)
+		kfree(assoc);
 	return err;
 }
 
-- 
2.34.1
Re: [PATCH] crypto: essiv: avoid request access after subrequest
Posted by Ard Biesheuvel 3 days, 5 hours ago 

On Mon, 21 Sep 2026, at 11:04, Jiale Yao wrote:
> essiv_aead_crypt() reads rctx->assoc after submitting the child AEAD
> request. An asynchronous completion can run essiv_aead_done(), free the
> association buffer, and complete the outer request before the submission
> call returns. The later request-context access can therefore use freed
> memory and trigger a second free.
>
> Snapshot the association buffer pointer before submitting the child
> request and use the local value for synchronous cleanup.
>
> Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV 
> generation")
>
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  crypto/essiv.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/crypto/essiv.c b/crypto/essiv.c
> index a47a3eab6935..5aea4584d5cb 100644
> --- a/crypto/essiv.c
> +++ b/crypto/essiv.c
> @@ -189,6 +189,7 @@ static int essiv_aead_crypt(struct aead_request 
> *req, bool enc)
>  	int ivsize = crypto_aead_ivsize(tfm);
>  	int ssize = req->assoclen - ivsize;
>  	struct scatterlist *src = req->src;
> +	void *assoc;
>  	int err;
> 
>  	if (ssize < 0)
> @@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request 
> *req, bool enc)
>  				  essiv_aead_done, req);
>  	aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv);
> 
> +	assoc = rctx->assoc;
>  	err = enc ? crypto_aead_encrypt(subreq) :
>  		    crypto_aead_decrypt(subreq);
> 
> -	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
> -		kfree(rctx->assoc);
> +	if (assoc && err != -EINPROGRESS && err != -EBUSY)
> +		kfree(assoc);
>  	return err;
>  }
> 

The problem here seems to be that rctx is dereferenced before the comparison
of err. Just drop it completely from the if: kfree() ignores NULL pointers
anyway.
Re:[PATCH] crypto: essiv: avoid request access after subrequest
Posted by jiale yao 3 days, 9 hours ago 
The KASAN is below:
[   31.903236] BUG: KASAN: double-free in essiv_aead_crypt+0x7d3/0xa90
[   31.903799] Free of addr ffff888105ecc000 by task poc/90
[   31.904262] 
  [1] sendmsg(as[   31.904414] CPU: 3 UID: 0 PID: 90 Comm: poc Not tainted 6.18.52 #5 PREEMPT(voluntary) 
soclen=8208 ssiz[   31.904418] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[   31.904419] Call Trace:
[   31.904422]  <TASK>
[   31.904423]  dump_stack_lvl+0x48/0x120
[   31.904440]  print_report+0x191/0x580
[   31.904452]  ? essiv_aead_crypt+0x7d3/0xa90
[   31.904454]  kasan_report_invalid_free+0x103/0x130
[   31.904456]  ? essiv_aead_crypt+0x7d3/0xa90
[   31.904457]  ? essiv_aead_crypt+0x7d3/0xa90
e=8192 cryptlen=[   31.904458]  check_slab_allocation+0x102/0x150
[   31.904460]  kfree+0xae/0x410
[   31.904461]  ? essiv_aead_crypt+0x7d3/0xa90
[   31.904463]  essiv_aead_crypt+0x7d3/0xa90
[   31.904464]  aead_recvmsg+0xaaa/0xe80
64) -> 8272 (que[   31.904467]  ? __pfx_aead_recvmsg+0x10/0x10
[   31.904469]  sock_recvmsg+0x139/0x180
[   31.904480]  ____sys_recvmsg+0x15d/0x360
[   31.904482]  ___sys_recvmsg+0x165/0x630
[   31.904484]  __x64_sys_recvmsg+0x121/0x180
[   31.904486]  do_syscall_64+0xcf/0x2e0
ued)
[   31.904489]  ? fpregs_assert_state_consistent+0x4b/0xf0
[   31.904491]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   31.904493] RIP: 0033:0x453a7d
[   31.904495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 41 54 48 83 ec 10 64 8b 04 25 18 00 00 00 85 c0 75 22 b8 2f 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5b 4c 63 e0 48 83 c4 10 4c 89 e0 41 5c c3 66
[   31.904496] RSP: 002b:00007ffcb84371c0 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
[   31.904499] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000453a7d
[   31.904500] RDX: 0000000000000040 RSI: 00007ffcb84371f0 RDI: 0000000000000004
[   31.904501] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[   31.904502] R10: 000000000049a19f R11: 0000000000000246 R12: 0000000001a8a7e0
[   31.904502] R13: 0000000001a88780 R14: 00007ffcb84371f0 R15: 0000000000000004
[   31.904504]  </TASK>
[   31.904504] 
[   31.919640] Allocated by task 90:
[   31.919941]  kasan_save_track+0x3f/0x80
[   31.920276]  __kasan_kmalloc+0x82/0x90
[   31.920596]  __kmalloc_noprof+0x26d/0x550
[   31.920940]  essiv_aead_crypt+0x7f6/0xa90
[   31.921290]  aead_recvmsg+0xaaa/0xe80
[   31.921620]  sock_recvmsg+0x139/0x180
[   31.921936]  ____sys_recvmsg+0x15d/0x360
[   31.922269]  ___sys_recvmsg+0x165/0x630
[   31.922595]  __x64_sys_recvmsg+0x121/0x180
[   31.922940]  do_syscall_64+0xcf/0x2e0
[   31.923251]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   31.923707] 
[   31.923851] Freed by task 90:
[   31.924145]  kasan_save_track+0x3f/0x80
[   31.924470]  __kasan_save_free_info+0x40/0x50
[   31.924838]  __kasan_slab_free+0x3a/0x60
[   31.925173]  kfree+0x100/0x410
[   31.925471]  essiv_aead_done+0x45/0x90
[   31.925791]  crypto_authenc_encrypt+0x5d5/0x830
[   31.926176]  essiv_aead_crypt+0x799/0xa90
[   31.926512]  aead_recvmsg+0xaaa/0xe80
[   31.926828]  sock_recvmsg+0x139/0x180
[   31.927144]  ____sys_recvmsg+0x15d/0x360
[   31.927520]  ___sys_recvmsg+0x165/0x630
[   31.927870]  __x64_sys_recvmsg+0x121/0x180
[   31.928236]  do_syscall_64+0xcf/0x2e0
[   31.928565]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   31.929018] 
[   31.929188] The buggy address belongs to the object at ffff888105ecc000
[   31.929188]  which belongs to the cache kmalloc-8k of size 8192
[   31.930195] The buggy address is located 0 bytes inside of
[   31.930195]  8192-byte region [ffff888105ecc000, ffff888105ece000)



At 2026-09-21 17:04:57, "Jiale Yao" <yaojiale02@163.com> wrote:
>essiv_aead_crypt() reads rctx->assoc after submitting the child AEAD
>request. An asynchronous completion can run essiv_aead_done(), free the
>association buffer, and complete the outer request before the submission
>call returns. The later request-context access can therefore use freed
>memory and trigger a second free.
>
>Snapshot the association buffer pointer before submitting the child
>request and use the local value for synchronous cleanup.
>
>Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
>
>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> crypto/essiv.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
>diff --git a/crypto/essiv.c b/crypto/essiv.c
>index a47a3eab6935..5aea4584d5cb 100644
>--- a/crypto/essiv.c
>+++ b/crypto/essiv.c
>@@ -189,6 +189,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
> 	int ivsize = crypto_aead_ivsize(tfm);
> 	int ssize = req->assoclen - ivsize;
> 	struct scatterlist *src = req->src;
>+	void *assoc;
> 	int err;
> 
> 	if (ssize < 0)
>@@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
> 				  essiv_aead_done, req);
> 	aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv);
> 
>+	assoc = rctx->assoc;
> 	err = enc ? crypto_aead_encrypt(subreq) :
> 		    crypto_aead_decrypt(subreq);
> 
>-	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
>-		kfree(rctx->assoc);
>+	if (assoc && err != -EINPROGRESS && err != -EBUSY)
>+		kfree(assoc);
> 	return err;
> }
> 
>-- 
>2.34.1

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.