CVE-2017-15116: NULL Pointer Dereference (CWE-476)
value: The rngapi_reset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service (NULL pointer dereference).
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2017-11-30T18:29Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: crypto/rng.c, include/crypto/internal/rng.h, include/crypto/rng.h, include/linux/crypto.h
Commit date: 2015-04-22 09:30:20 +0800
Commit message: crypto: rng - Remove old low-level rng interface

Now that all rng implementations have switched over to the new
interface, we can remove the old low-level interface.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Diff: diff --git a/crypto/rng.c b/crypto/rng.c
index e98ce1ca527dc3..055e276427b120 100644
--- a/crypto/rng.c
+++ b/crypto/rng.c
@@ -2,10 +2,11 @@
  * Cryptographic API.
  *
  * RNG operations.
  *
  * Copyright (c) 2008 Neil Horman <nhorman@tuxdriver.com>
+ * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
  * Software Foundation; either version 2 of the License, or (at your option)
  * any later version.
@@ -34,43 +35,10 @@ static int crypto_default_rng_refcnt;
 static inline struct crypto_rng *__crypto_rng_cast(struct crypto_tfm *tfm)
 {
 	return container_of(tfm, struct crypto_rng, base);
 }
 
-static inline struct old_rng_alg *crypto_old_rng_alg(struct crypto_rng *tfm)
-{
-	return &crypto_rng_tfm(tfm)->__crt_alg->cra_rng;
-}
-
-static int generate(struct crypto_rng *tfm, const u8 *src, unsigned int slen,
-		    u8 *dst, unsigned int dlen)
-{
-	return crypto_old_rng_alg(tfm)->rng_make_random(tfm, dst, dlen);
-}
-
-static int rngapi_reset(struct crypto_rng *tfm, const u8 *seed,
-			unsigned int slen)
-{
-	u8 *buf = NULL;
-	u8 *src = (u8 *)seed;
-	int err;
-
-	if (slen) {
-		buf = kmalloc(slen, GFP_KERNEL);
-		if (!buf)
-			return -ENOMEM;
-
-		memcpy(buf, seed, slen);
-		src = buf;
-	}
-
-	err = crypto_old_rng_alg(tfm)->rng_reset(tfm, src, slen);
-
-	kzfree(buf);
-	return err;
-}
-
 int crypto_rng_reset(struct crypto_rng *tfm, const u8 *seed, unsigned int slen)
 {
 	u8 *buf = NULL;
 	int err;
 
@@ -81,43 +49,27 @@ int crypto_rng_reset(struct crypto_rng *tfm, const u8 *seed, unsigned int slen)
 
 		get_random_bytes(buf, slen);
 		seed = buf;
 	}
 
-	err = tfm->seed(tfm, seed, slen);
+	err = crypto_rng_alg(tfm)->seed(tfm, seed, slen);
 
 	kfree(buf);
 	return err;
 }
 EXPORT_SYMBOL_GPL(crypto_rng_reset);
 
 static int crypto_rng_init_tfm(struct crypto_tfm *tfm)
 {
-	struct crypto_rng *rng = __crypto_rng_cast(tfm);
-	struct rng_alg *alg = crypto_rng_alg(rng);
-	struct old_rng_alg *oalg = crypto_old_rng_alg(rng);
-
-	if (oalg->rng_make_random) {
-		rng->generate = generate;
-		rng->seed = rngapi_reset;
-		rng->seedsize = oalg->seedsize;
-		return 0;
-	}
-
-	rng->generate = alg->generate;
-	rng->seed = alg->seed;
-	rng->seedsize = alg->seedsize;
-
 	return 0;
 }
 
 static unsigned int seedsize(struct crypto_alg *alg)
 {
 	struct rng_alg *ralg = container_of(alg, struct rng_alg, base);
 
-	return alg->cra_rng.rng_make_random ?
-	       alg->cra_rng.seedsize : ralg->seedsize;
+	return ralg->seedsize;
 }
 
 #ifdef CONFIG_NET
 static int crypto_rng_report(struct sk_buff *skb, struct crypto_alg *alg)
 {
@@ -148,11 +100,11 @@ static void crypto_rng_show(struct seq_file *m, struct crypto_alg *alg)
 {
 	seq_printf(m, "type         : rng\n");
 	seq_printf(m, "seedsize     : %u\n", seedsize(alg));
 }
 
-const struct crypto_type crypto_rng_type = {
+static const struct crypto_type crypto_rng_type = {
 	.extsize = crypto_alg_extsize,
 	.init_tfm = crypto_rng_init_tfm,
 #ifdef CONFIG_PROC_FS
 	.show = crypto_rng_show,
 #endif
@@ -160,11 +112,10 @@ const struct crypto_type crypto_rng_type = {
 	.maskclear = ~CRYPTO_ALG_TYPE_MASK,
 	.maskset = CRYPTO_ALG_TYPE_MASK,
 	.type = CRYPTO_ALG_TYPE_RNG,
 	.tfmsize = offsetof(struct crypto_rng, base),
 };
-EXPORT_SYMBOL_GPL(crypto_rng_type);
 
 struct crypto_rng *crypto_alloc_rng(const char *alg_name, u32 type, u32 mask)
 {
 	return crypto_alloc_tfm(alg_name, &crypto_rng_type, type, mask);
 }
diff --git a/include/crypto/internal/rng.h b/include/crypto/internal/rng.h
index 2c9a865c66e268..263f1a5eebc707 100644
--- a/include/crypto/internal/rng.h
+++ b/include/crypto/internal/rng.h
@@ -1,9 +1,10 @@
 /*
  * RNG: Random Number Generator  algorithms under the crypto API
  *
  * Copyright (c) 2008 Neil Horman <nhorman@tuxdriver.com>
+ * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
  * Software Foundation; either version 2 of the License, or (at your option)
  * any later version.
@@ -14,12 +15,10 @@
 #define _CRYPTO_INTERNAL_RNG_H
 
 #include <crypto/algapi.h>
 #include <crypto/rng.h>
 
-extern const struct crypto_type crypto_rng_type;
-
 int crypto_register_rng(struct rng_alg *alg);
 void crypto_unregister_rng(struct rng_alg *alg);
 int crypto_register_rngs(struct rng_alg *algs, int count);
 void crypto_unregister_rngs(struct rng_alg *algs, int count);
 
diff --git a/include/crypto/rng.h b/include/crypto/rng.h
index cc22e52a129aaf..c5d4684429f585 100644
--- a/include/crypto/rng.h
+++ b/include/crypto/rng.h
@@ -1,9 +1,10 @@
 /*
  * RNG: Random Number Generator  algorithms under the crypto API
  *
  * Copyright (c) 2008 Neil Horman <nhorman@tuxdriver.com>
+ * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
  * Software Foundation; either version 2 of the License, or (at your option)
  * any later version.
@@ -54,15 +55,10 @@ struct rng_alg {
 
 	struct crypto_alg base;
 };
 
 struct crypto_rng {
-	int (*generate)(struct crypto_rng *tfm,
-			const u8 *src, unsigned int slen,
-			u8 *dst, unsigned int dlen);
-	int (*seed)(struct crypto_rng *tfm, const u8 *seed, unsigned int slen);
-	unsigned int seedsize;
 	struct crypto_tfm base;
 };
 
 extern struct crypto_rng *crypto_default_rng;
 
@@ -142,11 +138,11 @@ static inline void crypto_free_rng(struct crypto_rng *tfm)
  */
 static inline int crypto_rng_generate(struct crypto_rng *tfm,
 				      const u8 *src, unsigned int slen,
 				      u8 *dst, unsigned int dlen)
 {
-	return tfm->generate(tfm, src, slen, dst, dlen);
+	return crypto_rng_alg(tfm)->generate(tfm, src, slen, dst, dlen);
 }
 
 /**
  * crypto_rng_get_bytes() - get random number
  * @tfm: cipher handle
@@ -196,9 +192,9 @@ int crypto_rng_reset(struct crypto_rng *tfm, const u8 *seed,
  *
  * Return: seed size for the random number generator
  */
 static inline int crypto_rng_seedsize(struct crypto_rng *tfm)
 {
-	return tfm->seedsize;
+	return crypto_rng_alg(tfm)->seedsize;
 }
 
 #endif
diff --git a/include/linux/crypto.h b/include/linux/crypto.h
index 2fa9b05360f7b3..ee14140f8893b9 100644
--- a/include/linux/crypto.h
+++ b/include/linux/crypto.h
@@ -136,11 +136,10 @@ struct scatterlist;
 struct crypto_ablkcipher;
 struct crypto_async_request;
 struct crypto_aead;
 struct crypto_blkcipher;
 struct crypto_hash;
-struct crypto_rng;
 struct crypto_tfm;
 struct crypto_type;
 struct aead_givcrypt_request;
 struct skcipher_givcrypt_request;
 
@@ -424,44 +423,16 @@ struct compress_alg {
 			    unsigned int slen, u8 *dst, unsigned int *dlen);
 	int (*coa_decompress)(struct crypto_tfm *tfm, const u8 *src,
 			      unsigned int slen, u8 *dst, unsigned int *dlen);
 };
 
-/**
- * struct old_rng_alg - random number generator definition
- * @rng_make_random: The function defined by this variable obtains a random
- *		     number. The random number generator transform must generate
- *		     the random number out of the context provided with this
- *		     call.
- * @rng_reset: Reset of the random number generator by clearing the entire state.
- *	       With the invocation of this function call, the random number
- *             generator shall completely reinitialize its state. If the random
- *	       number generator requires a seed for setting up a new state,
- *	       the seed must be provided by the consumer while invoking this
- *	       function. The required size of the seed is defined with
- *	       @seedsize .
- * @seedsize: The seed size required for a random number generator
- *	      initialization defined with this variable. Some random number
- *	      generators like the SP800-90A DRBG does not require a seed as the
- *	      seeding is implemented internally without the need of support by
- *	      the consumer. In this case, the seed size is set to zero.
- */
-struct old_rng_alg {
-	int (*rng_make_random)(struct crypto_rng *tfm, u8 *rdata,
-			       unsigned int dlen);
-	int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
-
-	unsigned int seedsize;
-};
-
 
 #define cra_ablkcipher	cra_u.ablkcipher
 #define cra_aead	cra_u.aead
 #define cra_blkcipher	cra_u.blkcipher
 #define cra_cipher	cra_u.cipher
 #define cra_compress	cra_u.compress
-#define cra_rng		cra_u.rng
 
 /**
  * struct crypto_alg - definition of a cryptograpic cipher algorithm
  * @cra_flags: Flags describing this transformation. See include/linux/crypto.h
  *	       CRYPTO_ALG_* flags for the flags which go in here. Those are
@@ -557,11 +528,10 @@ struct crypto_alg {
 		struct ablkcipher_alg ablkcipher;
 		struct aead_alg aead;
 		struct blkcipher_alg blkcipher;
 		struct cipher_alg cipher;
 		struct compress_alg compress;
-		struct old_rng_alg rng;
 	} cra_u;
 
 	int (*cra_init)(struct crypto_tfm *tfm);
 	void (*cra_exit)(struct crypto_tfm *tfm);
 	void (*cra_destroy)(struct crypto_alg *alg);

Vulnerable code: static inline struct old_rng_alg *crypto_old_rng_alg(struct crypto_rng *tfm)
{
	return &crypto_rng_tfm(tfm)->__crt_alg->cra_rng;
}

static int generate(struct crypto_rng *tfm, const u8 *src, unsigned int slen,
		    u8 *dst, unsigned int dlen)
{
	return crypto_old_rng_alg(tfm)->rng_make_random(tfm, dst, dlen);
}

static int rngapi_reset(struct crypto_rng *tfm, const u8 *seed,
			unsigned int slen)
{
	u8 *buf = NULL;
	u8 *src = (u8 *)seed;
	int err;

	if (slen) {
		buf = kmalloc(slen, GFP_KERNEL);
		if (!buf)
			return -ENOMEM;

		memcpy(buf, seed, slen);
		src = buf;
	}

	err = crypto_old_rng_alg(tfm)->rng_reset(tfm, src, slen);

	kzfree(buf);
	return err;
}

	err = tfm->seed(tfm, seed, slen);
	struct crypto_rng *rng = __crypto_rng_cast(tfm);
	struct rng_alg *alg = crypto_rng_alg(rng);
	struct old_rng_alg *oalg = crypto_old_rng_alg(rng);

	if (oalg->rng_make_random) {
		rng->generate = generate;
		rng->seed = rngapi_reset;
		rng->seedsize = oalg->seedsize;
		return 0;
	}

	rng->generate = alg->generate;
	rng->seed = alg->seed;
	rng->seedsize = alg->seedsize;

	return alg->cra_rng.rng_make_random ?
	       alg->cra_rng.seedsize : ralg->seedsize;
const struct crypto_type crypto_rng_type = {
EXPORT_SYMBOL_GPL(crypto_rng_type);
extern const struct crypto_type crypto_rng_type;

	int (*generate)(struct crypto_rng *tfm,
			const u8 *src, unsigned int slen,
			u8 *dst, unsigned int dlen);
	int (*seed)(struct crypto_rng *tfm, const u8 *seed, unsigned int slen);
	unsigned int seedsize;
	return tfm->generate(tfm, src, slen, dst, dlen);
	return tfm->seedsize;
struct crypto_rng;
/**
 * struct old_rng_alg - random number generator definition
 * @rng_make_random: The function defined by this variable obtains a random
 *		     number. The random number generator transform must generate
 *		     the random number out of the context provided with this
 *		     call.
 * @rng_reset: Reset of the random number generator by clearing the entire state.
 *	       With the invocation of this function call, the random number
 *             generator shall completely reinitialize its state. If the random
 *	       number generator requires a seed for setting up a new state,
 *	       the seed must be provided by the consumer while invoking this
 *	       function. The required size of the seed is defined with
 *	       @seedsize .
 * @seedsize: The seed size required for a random number generator
 *	      initialization defined with this variable. Some random number
 *	      generators like the SP800-90A DRBG does not require a seed as the
 *	      seeding is implemented internally without the need of support by
 *	      the consumer. In this case, the seed size is set to zero.
 */
struct old_rng_alg {
	int (*rng_make_random)(struct crypto_rng *tfm, u8 *rdata,
			       unsigned int dlen);
	int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);

	unsigned int seedsize;
};

#define cra_rng		cra_u.rng
		struct old_rng_alg rng;
Fixed code:  * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
	err = crypto_rng_alg(tfm)->seed(tfm, seed, slen);
	return ralg->seedsize;
static const struct crypto_type crypto_rng_type = {
 * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
 * Copyright (c) 2015 Herbert Xu <herbert@gondor.apana.org.au>
	return crypto_rng_alg(tfm)->generate(tfm, src, slen, dst, dlen);
	return crypto_rng_alg(tfm)->seedsize;