Messages in this thread |  | | Date | Fri, 15 May 2026 18:27:05 +0800 | | From | Herbert Xu <> | | Subject | Re: [PATCH v2] crypto: krb5 - filter out async aead implementations at alloc |
| |
On Sun, May 10, 2026 at 07:24:55PM -0400, Michael Bommarito wrote: > krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and > rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL > completion callback and treat any negative return from > crypto_aead_{encrypt,decrypt}() as terminal, falling through to > kfree_sensitive(buffer). When the encrypt_name resolves to an > async AEAD instance the request returns -EINPROGRESS, the buffer > is freed while the backend's worker still holds a pointer, and the > worker dereferences the freed slab on completion. > > KASAN report under UML+SLUB with a synthetic async aead backend > bound to krb5->encrypt_name: > > BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7 > > The helpers were written synchronously, so filter the async > instances out at allocation time instead of plumbing > crypto_wait_req() through every call site. > > Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and > net/ceph/crypto.c on systems with an async AEAD provider bound to > the krb5 enctype name. > > Fixes: 00244da40f78 ("crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions") > Fixes: 6c3c0e86c2ac ("crypto/krb5: Implement the AES enctypes from rfc8009") > Cc: stable@vger.kernel.org > Suggested-by: Herbert Xu <herbert@gondor.apana.org.au> > Assisted-by: Claude:claude-opus-4-7 > Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> > --- > crypto/krb5/krb5_api.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-)
Patch applied. Thanks. -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
|  |