Patch "crypto: pcrypt - Delay write to padata->info" has been added to the 4.14-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    crypto: pcrypt - Delay write to padata->info

to the 4.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     crypto-pcrypt-delay-write-to-padata-info.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f45d947c3868e7a1933a50c7855ba952c56d6801
Author: Daniel Jordan <daniel.m.jordan@xxxxxxxxxx>
Date:   Thu Oct 21 14:30:28 2021 -0400

    crypto: pcrypt - Delay write to padata->info
    
    [ Upstream commit 68b6dea802cea0dbdd8bd7ccc60716b5a32a5d8a ]
    
    These three events can race when pcrypt is used multiple times in a
    template ("pcrypt(pcrypt(...))"):
    
      1.  [taskA] The caller makes the crypto request via crypto_aead_encrypt()
      2.  [kworkerB] padata serializes the inner pcrypt request
      3.  [kworkerC] padata serializes the outer pcrypt request
    
    3 might finish before the call to crypto_aead_encrypt() returns in 1,
    resulting in two possible issues.
    
    First, a use-after-free of the crypto request's memory when, for
    example, taskA writes to the outer pcrypt request's padata->info in
    pcrypt_aead_enc() after kworkerC completes the request.
    
    Second, the outer pcrypt request overwrites the inner pcrypt request's
    return code with -EINPROGRESS, making a successful request appear to
    fail.  For instance, kworkerB writes the outer pcrypt request's
    padata->info in pcrypt_aead_done() and then taskA overwrites it
    in pcrypt_aead_enc().
    
    Avoid both situations by delaying the write of padata->info until after
    the inner crypto request's return code is checked.  This prevents the
    use-after-free by not touching the crypto request's memory after the
    next-inner crypto request is made, and stops padata->info from being
    overwritten.
    
    Fixes: 5068c7a883d16 ("crypto: pcrypt - Add pcrypt crypto parallelization wrapper")
    Reported-by: syzbot+b187b77c8474f9648fae@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Daniel Jordan <daniel.m.jordan@xxxxxxxxxx>
    Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index 85082574c5154..62e11835f220e 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -138,12 +138,14 @@ static void pcrypt_aead_enc(struct padata_priv *padata)
 {
 	struct pcrypt_request *preq = pcrypt_padata_request(padata);
 	struct aead_request *req = pcrypt_request_ctx(preq);
+	int ret;
 
-	padata->info = crypto_aead_encrypt(req);
+	ret = crypto_aead_encrypt(req);
 
-	if (padata->info == -EINPROGRESS)
+	if (ret == -EINPROGRESS)
 		return;
 
+	padata->info = ret;
 	padata_do_serial(padata);
 }
 
@@ -180,12 +182,14 @@ static void pcrypt_aead_dec(struct padata_priv *padata)
 {
 	struct pcrypt_request *preq = pcrypt_padata_request(padata);
 	struct aead_request *req = pcrypt_request_ctx(preq);
+	int ret;
 
-	padata->info = crypto_aead_decrypt(req);
+	ret = crypto_aead_decrypt(req);
 
-	if (padata->info == -EINPROGRESS)
+	if (ret == -EINPROGRESS)
 		return;
 
+	padata->info = ret;
 	padata_do_serial(padata);
 }