)]}'
{
  "commit": "4b900641754c53dcf4e7ebf7bd6cc2e9779c6ff3",
  "tree": "f5f7738d8ef5b1c336d7d8a93d7737498a061241",
  "parents": [
    "990e47782e40868c425f19e26ef7f049f828a9e1"
  ],
  "author": {
    "name": "Eric Biggers",
    "email": "ebiggers@google.com",
    "time": "Mon Jul 23 10:54:57 2018 -0700"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Fri Aug 17 21:03:48 2018 +0200"
  },
  "message": "crypto: blkcipher - fix crash flushing dcache in error path\n\ncommit 0868def3e4100591e7a1fdbf3eed1439cc8f7ca3 upstream.\n\nLike the skcipher_walk case:\n\nscatterwalk_done() is only meant to be called after a nonzero number of\nbytes have been processed, since scatterwalk_pagedone() will flush the\ndcache of the *previous* page.  But in the error case of\nblkcipher_walk_done(), e.g. if the input wasn\u0027t an integer number of\nblocks, scatterwalk_done() was actually called after advancing 0 bytes.\nThis caused a crash (\"BUG: unable to handle kernel paging request\")\nduring \u0027!PageSlab(page)\u0027 on architectures like arm and arm64 that define\nARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE, provided that the input was\npage-aligned as in that case walk-\u003eoffset \u003d\u003d 0.\n\nFix it by reorganizing blkcipher_walk_done() to skip the\nscatterwalk_advance() and scatterwalk_done() if an error has occurred.\n\nThis bug was found by syzkaller fuzzing.\n\nReproducer, assuming ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE:\n\n\t#include \u003clinux/if_alg.h\u003e\n\t#include \u003csys/socket.h\u003e\n\t#include \u003cunistd.h\u003e\n\n\tint main()\n\t{\n\t\tstruct sockaddr_alg addr \u003d {\n\t\t\t.salg_type \u003d \"skcipher\",\n\t\t\t.salg_name \u003d \"ecb(aes-generic)\",\n\t\t};\n\t\tchar buffer[4096] __attribute__((aligned(4096))) \u003d { 0 };\n\t\tint fd;\n\n\t\tfd \u003d socket(AF_ALG, SOCK_SEQPACKET, 0);\n\t\tbind(fd, (void *)\u0026addr, sizeof(addr));\n\t\tsetsockopt(fd, SOL_ALG, ALG_SET_KEY, buffer, 16);\n\t\tfd \u003d accept(fd, NULL, NULL);\n\t\twrite(fd, buffer, 15);\n\t\tread(fd, buffer, 15);\n\t}\n\nReported-by: Liu Chao \u003cliuchao741@huawei.com\u003e\nFixes: 5cde0af2a982 (\"[CRYPTO] cipher: Added block cipher type\")\nCc: \u003cstable@vger.kernel.org\u003e # v2.6.19+\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "01c0d4aa2563f8b2104d9e0e7c64e699c19e39e0",
      "old_mode": 33188,
      "old_path": "crypto/blkcipher.c",
      "new_id": "77b5fa293f666381af42fbc43331a356230bdff3",
      "new_mode": 33188,
      "new_path": "crypto/blkcipher.c"
    }
  ]
}