linux.git/crypto, branch v6.1.154

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

2025-09-25T08:58:55+00:00

[ Upstream commit 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ]

Issuing two writes to the same af_alg socket is bogus as the
data will be interleaved in an unpredictable fashion.  Furthermore,
concurrent writes may create inconsistencies in the internal
socket state.

Disallow this by adding a new ctx->write field that indiciates
exclusive ownership for writing.

Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations")
Reported-by: Muhammad Alifa Ramdhan 
Reported-by: Bing-Jhong Billy Jheng 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

crypto: af_alg: Convert af_alg_sendpage() to use MSG_SPLICE_PAGES

2025-09-25T08:58:55+00:00

[ Upstream commit fb800fa4c1f5aee1238267252e88a7837e645c02 ]

Convert af_alg_sendpage() to use sendmsg() with MSG_SPLICE_PAGES rather
than directly splicing in the pages itself.

This allows ->sendpage() to be replaced by something that can handle
multiple multipage folios in a single transaction.

Signed-off-by: David Howells 
cc: Herbert Xu 
cc: "David S. Miller" 
cc: Eric Dumazet 
cc: Jakub Kicinski 
cc: Paolo Abeni 
cc: Jens Axboe 
cc: Matthew Wilcox 
cc: linux-crypto@vger.kernel.org
cc: netdev@vger.kernel.org
Acked-by: Herbert Xu 
Signed-off-by: Paolo Abeni 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

crypto: af_alg - Set merge to zero early in af_alg_sendmsg

2025-09-25T08:58:54+00:00

[ Upstream commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f ]

If an error causes af_alg_sendmsg to abort, ctx->merge may contain
a garbage value from the previous loop.  This may then trigger a
crash on the next entry into af_alg_sendmsg when it attempts to do
a merge that can't be done.

Fix this by setting ctx->merge to zero near the start of the loop.

Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations")
Reported-by: Muhammad Alifa Ramdhan 
Reported-by: Bing-Jhong Billy Jheng 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: af_alg: Indent the loop in af_alg_sendmsg()

2025-09-25T08:58:54+00:00

[ Upstream commit 73d7409cfdad7fd08a9203eb2912c1c77e527776 ]

Put the loop in af_alg_sendmsg() into an if-statement to indent it to make
the next patch easier to review as that will add another branch to handle
MSG_SPLICE_PAGES to the if-statement.

Signed-off-by: David Howells 
cc: Herbert Xu 
cc: "David S. Miller" 
cc: Eric Dumazet 
cc: Jakub Kicinski 
cc: Paolo Abeni 
cc: Jens Axboe 
cc: Matthew Wilcox 
cc: linux-crypto@vger.kernel.org
cc: netdev@vger.kernel.org
Acked-by: Herbert Xu 
Signed-off-by: Paolo Abeni 
Stable-dep-of: 9574b2330dbd ("crypto: af_alg - Set merge to zero early in af_alg_sendmsg")
Signed-off-by: Sasha Levin

crypto: xts - Only add ecb if it is not already there

2025-06-27T10:07:06+00:00

[ Upstream commit 270b6f13454cb7f2f7058c50df64df409c5dcf55 ]

Only add ecb to the cipher name if it isn't already ecb.

Also use memcmp instead of strncmp since these strings are all
stored in an array of length CRYPTO_MAX_ALG_NAME.

Fixes: f1c131b45410 ("crypto: xts - Convert to skcipher")
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: lrw - Only add ecb if it is not already there

2025-06-27T10:07:06+00:00

[ Upstream commit 3d73909bddc2ebb3224a8bc2e5ce00e9df70c15d ]

Only add ecb to the cipher name if it isn't already ecb.

Also use memcmp instead of strncmp since these strings are all
stored in an array of length CRYPTO_MAX_ALG_NAME.

Fixes: 700cb3f5fe75 ("crypto: lrw - Convert to skcipher")
Reported-by: kernel test robot 
Closes: https://lore.kernel.org/oe-lkp/202505151503.d8a6cf10-lkp@intel.com
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: algif_hash - fix double free in hash_accept

2025-06-04T12:40:20+00:00

commit b2df03ed4052e97126267e8c13ad4204ea6ba9b6 upstream.

If accept(2) is called on socket type algif_hash with
MSG_MORE flag set and crypto_ahash_import fails,
sk2 is freed. However, it is also freed in af_alg_release,
leading to slab-use-after-free error.

Fixes: fe869cdb89c9 ("crypto: algif_hash - User-space interface for hash operations")
Cc: 
Signed-off-by: Ivan Pravdin 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

crypto: lzo - Fix compression buffer overrun

2025-06-04T12:40:08+00:00

[ Upstream commit cc47f07234f72cbd8e2c973cdbf2a6730660a463 ]

Unlike the decompression code, the compression code in LZO never
checked for output overruns.  It instead assumes that the caller
always provides enough buffer space, disregarding the buffer length
provided by the caller.

Add a safe compression interface that checks for the end of buffer
before each write.  Use the safe interface in crypto/lzo.

Signed-off-by: Herbert Xu 
Reviewed-by: David Sterba 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: null - Use spin lock instead of mutex

2025-05-02T05:47:01+00:00

[ Upstream commit dcc47a028c24e793ce6d6efebfef1a1e92f80297 ]

As the null algorithm may be freed in softirq context through
af_alg, use spin locks instead of mutexes to protect the default
null algorithm.

Reported-by: syzbot+b3e02953598f447d4d2a@syzkaller.appspotmail.com
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: api - Add crypto_clone_tfm

2024-12-14T18:53:51+00:00

[ Upstream commit 3c3a24cb0ae46c9c45e4ce2272f84f0504831f59 ]

This patch adds the helper crypto_clone_tfm.  The purpose is to
allocate a tfm object with GFP_ATOMIC.  As we cannot sleep, the
object has to be cloned from an existing tfm object.

This allows code paths that cannot otherwise allocate a crypto_tfm
object to do so.  Once a new tfm has been obtained its key could
then be changed without impacting other users.

Signed-off-by: Herbert Xu 
Reviewed-by: Simon Horman 
Signed-off-by: Herbert Xu 
Stable-dep-of: 1465036b10be ("llc: Improve setsockopt() handling of malformed user input")
Signed-off-by: Sasha Levin