Re: WARNING: refcount bug in crypto_mod_get

[Herbert Xu]

On Fri, May 01, 2020 at 10:01:14AM -0700, syzbot wrote:
>
> ------------[ cut here ]------------
> refcount_t: addition on 0; use-after-free.
...
>  refcount_add include/linux/refcount.h:204 [inline]
>  refcount_inc include/linux/refcount.h:241 [inline]
>  crypto_alg_get crypto/internal.h:87 [inline]
>  crypto_mod_get+0xc6/0xf0 crypto/api.c:37
>  crypto_spawn_alg.isra.0+0xa8/0x110 crypto/algapi.c:723
>  crypto_spawn_tfm2+0x19/0xb0 crypto/algapi.c:763
>  crypto_spawn_aead include/crypto/internal/aead.h:102 [inline]
>  pcrypt_aead_init_tfm+0x144/0x273 crypto/pcrypt.c:182
>  crypto_aead_init_tfm+0x138/0x1a0 crypto/aead.c:140
>  crypto_create_tfm+0xd5/0x2f0 crypto/api.c:454
>  crypto_alloc_tfm+0x100/0x340 crypto/api.c:526
>  aead_bind+0x69/0x170 crypto/algif_aead.c:483
>  alg_bind+0x260/0x530 crypto/af_alg.c:182
>  __sys_bind+0x20e/0x250 net/socket.c:1662
>  __do_sys_bind net/socket.c:1673 [inline]
>  __se_sys_bind net/socket.c:1671 [inline]
>  __x64_sys_bind+0x6f/0xb0 net/socket.c:1671
>  do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
>  entry_SYSCALL_64_after_hwframe+0x49/0xb3

This should be fixed already:

#syz fix: crypto: api - Fix use-after-free and race in crypto_spawn_alg

Cheers,
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt