)]}'
{
  "commit": "744ff5f0dc609e818e3ece7790ec4eff7fe3e9af",
  "tree": "140539fa6830fa5933de8af81037ad7ace8e558d",
  "parents": [
    "d5cceea6dda72f96fc6b23593bcfbc8821554fd5"
  ],
  "author": {
    "name": "Eric Biggers",
    "email": "ebiggers@google.com",
    "time": "Mon Jul 23 10:54:56 2018 -0700"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Fri Aug 17 21:03:49 2018 +0200"
  },
  "message": "crypto: skcipher - fix crash flushing dcache in error path\n\ncommit 8088d3dd4d7c6933a65aa169393b5d88d8065672 upstream.\n\nscatterwalk_done() is only meant to be called after a nonzero number of\nbytes have been processed, since scatterwalk_pagedone() will flush the\ndcache of the *previous* page.  But in the error case of\nskcipher_walk_done(), e.g. if the input wasn\u0027t an integer number of\nblocks, scatterwalk_done() was actually called after advancing 0 bytes.\nThis caused a crash (\"BUG: unable to handle kernel paging request\")\nduring \u0027!PageSlab(page)\u0027 on architectures like arm and arm64 that define\nARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE, provided that the input was\npage-aligned as in that case walk-\u003eoffset \u003d\u003d 0.\n\nFix it by reorganizing skcipher_walk_done() to skip the\nscatterwalk_advance() and scatterwalk_done() if an error has occurred.\n\nThis bug was found by syzkaller fuzzing.\n\nReproducer, assuming ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE:\n\n\t#include \u003clinux/if_alg.h\u003e\n\t#include \u003csys/socket.h\u003e\n\t#include \u003cunistd.h\u003e\n\n\tint main()\n\t{\n\t\tstruct sockaddr_alg addr \u003d {\n\t\t\t.salg_type \u003d \"skcipher\",\n\t\t\t.salg_name \u003d \"cbc(aes-generic)\",\n\t\t};\n\t\tchar buffer[4096] __attribute__((aligned(4096))) \u003d { 0 };\n\t\tint fd;\n\n\t\tfd \u003d socket(AF_ALG, SOCK_SEQPACKET, 0);\n\t\tbind(fd, (void *)\u0026addr, sizeof(addr));\n\t\tsetsockopt(fd, SOL_ALG, ALG_SET_KEY, buffer, 16);\n\t\tfd \u003d accept(fd, NULL, NULL);\n\t\twrite(fd, buffer, 15);\n\t\tread(fd, buffer, 15);\n\t}\n\nReported-by: Liu Chao \u003cliuchao741@huawei.com\u003e\nFixes: b286d8b1a690 (\"crypto: skcipher - Add skcipher walk interface\")\nCc: \u003cstable@vger.kernel.org\u003e # v4.10+\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "1064ee993e8cb07c648d21ea6a22f68ab8beb67b",
      "old_mode": 33188,
      "old_path": "crypto/skcipher.c",
      "new_id": "5dc8407bdaa90cdd00670c142f69651862773a0f",
      "new_mode": 33188,
      "new_path": "crypto/skcipher.c"
    }
  ]
}