Forum | Documentation | Website | Blog

Skip to content
Snippets Groups Projects
  • Pavel Skripkin's avatar
    crypto: fix uninit-value in af_alg_free_resources · 080aa61e
    Pavel Skripkin authored
    Syzbot was able to trigger use of uninitialized memory in
    af_alg_free_resources.
    
    Bug is caused by missing initialization of rsgl->sgl.need_unpin before
    adding to rsgl_list. Then in case of extract_iter_to_sg() failure, rsgl
    is left with uninitialized need_unpin which is read during clean up
    
    BUG: KMSAN: uninit-value in af_alg_free_sg crypto/af_alg.c:545 [inline]
    BUG: KMSAN: uninit-value in af_alg_free_areq_sgls crypto/af_alg.c:778 [inline]
    BUG: KMSAN: uninit-value in af_alg_free_resources+0x3d1/0xf60 crypto/af_alg.c:1117
     af_alg_free_sg crypto/af_alg.c:545 [inline]
     af_alg_free_areq_sgls crypto/af_alg.c:778 [inline]
     af_alg_free_resources+0x3d1/0xf60 crypto/af_alg.c:1117
     _skcipher_recvmsg crypto/algif_skcipher.c:144 [inline]
    ...
    
    Uninit was created at:
     slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767
     slab_alloc_node mm/slub.c:3470 [inline]
     __kmem_cache_alloc_node+0x536/0x8d0 mm/slub.c:3509
     __do_kmalloc_node mm/slab_common.c:984 [inline]
     __kmalloc+0x12...
    080aa61e
af_alg.c 28.47 KiB