In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
crypto: amlogic – avoid double cleanup in meson_crypto_probe()<\/p>\n
When meson_allocate_chanlist() fails after a partial allocation, it already
\nunwinds the allocated chanlist state through its local error path.
\nmeson_crypto_probe() then jump to error_flow and calls
\nmeson_free_chanlist() again, causing the same per-flow resources to be torn
\ndown twice. In the reproduced failure path, the second teardown
\nre-entered crypto_engine_exit() on an already destroyed worker and KASAN
\nreported a slab-use-after-free in kthread_destroy_worker().<\/p>\n
Prevent double-free by handling partial allocation failures locally within
\nmeson_allocate_chanlist() and skipping the outer cleanup path.<\/p>\n
The bug was first flagged by an experimental analysis tool we are
\ndeveloping for kernel memory-management bugs while analyzing
\nv6.13-rc1. The tool is still under development and is not yet publicly
\navailable.<\/p>\n
The bug was reproduced in a QEMU x86_64 guest booted with KASAN on v7.1,
\nusing the reproducer under tools\/testing\/meson_crypto_probe. The reproducer
\nforces the second dma_alloc_attrs() call in the gxl-crypto probe path to
\nreturn NULL, making meson_allocate_chanlist() fail after partial
\ninitialization. On the unpatched kernel this reliably triggered a
\nslab-use-after-free. With this fix applied, the same reproducer no longer
\nemits any KASAN report and the probe fails cleanly with -ENOMEM.<\/p>\n
==================================================================
\n BUG: KASAN: slab-use-after-free in kthread_destroy_worker+0xb2\/0xd0
\n Read of size 8 at addr ff1100010c057a68 by task insmod\/265<\/p>\n
CPU: 1 UID: 0 PID: 265 Comm: insmod Tainted: G O 7.1.0-rc2-00376-g810af9adc907-dirty #10 PREEMPT(lazy)
\n Tainted: [O]=OOT_MODULE
\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04\/01\/2014
\n Call Trace:<\/p>\n
dump_stack_lvl+0x68\/0xa0
\n print_report+0xcb\/0x5e0
\n ? __virt_addr_valid+0x21d\/0x3f0
\n ? kthread_destroy_worker+0xb2\/0xd0
\n ? kthread_destroy_worker+0xb2\/0xd0
\n kasan_report+0xca\/0x100
\n ? kthread_destroy_worker+0xb2\/0xd0
\n kthread_destroy_worker+0xb2\/0xd0
\n meson_crypto_probe+0x4d0\/0xc10 [amlogic_gxl_crypto]
\n platform_probe+0x99\/0x140
\n really_probe+0x1c6\/0x6a0
\n ? __pfx___device_attach_driver+0x10\/0x10
\n __driver_probe_device+0x248\/0x310
\n ? acpi_driver_match_device+0xb0\/0x100
\n driver_probe_device+0x48\/0x210
\n ? __pfx___device_attach_driver+0x10\/0x10
\n __device_attach_driver+0x160\/0x320
\n bus_for_each_drv+0x104\/0x190
\n ? __pfx_bus_for_each_drv+0x10\/0x10
\n ? _raw_spin_unlock_irqrestore+0x2c\/0x50
\n __device_attach+0x19d\/0x3b0
\n ? __pfx___device_attach+0x10\/0x10
\n ? do_raw_spin_unlock+0x53\/0x220
\n device_initial_probe+0x78\/0xa0
\n bus_probe_device+0x5b\/0x130
\n device_add+0xcfd\/0x1430
\n ? __pfx_device_add+0x10\/0x10
\n ? insert_resource+0x34\/0x50
\n ? lock_release+0xc9\/0x290
\n platform_device_add+0x24e\/0x590
\n ? __pfx_meson_crypto_probe_repro_init+0x10\/0x10 [meson_crypto_probe_repro]
\n meson_crypto_probe_repro_init+0x330\/0xff0 [meson_crypto_probe_repro]
\n do_one_initcall+0xc0\/0x450
\n ? __pfx_do_one_initcall+0x10\/0x10
\n ? _raw_spin_unlock_irqrestore+0x2c\/0x50
\n ? __create_object+0x59\/0x80
\n ? kasan_unpoison+0x27\/0x60
\n do_init_module+0x27b\/0x7d0
\n ? __pfx_do_init_module+0x10\/0x10
\n ? kasan_quarantine_put+0x84\/0x1d0
\n ? kfree+0x32c\/0x510
\n ? load_module+0x561e\/0x5ff0
\n load_module+0x54fe\/0x5ff0
\n ? __pfx_load_module+0x10\/0x10
\n ? security_file_permission+0x20\/0x40
\n ? kernel_read_file+0x23d\/0x6e0
\n ? mmap_region+0x235\/0x4a0
\n ? __pfx_kernel_read_file+0x10\/0x10
\n ? __file_has_perm+0x2c0\/0x3e0
\n init_module_from_file+0x158\/0x180
\n ? __pfx_init_module_from_file+0x10\/0x10
\n ? __lock_acquire+0x45a\/0x1ba0
\n ? idempotent_init_module+0x315\/0x610
\n ? lock_release+0xc9\/0x290
\n ? lock
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
crypto: amlogic – avoid double cleanup in meson_crypto_probe()<\/p>\n
When meson_allocate_chanlist() fails after a partial allocation, it<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4881","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4881","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4881"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4881"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4881"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}