linux-kernel - Re: [PATCH 1/2 v2] scripts/coccinelle: catch freeing cryptographic structures via kfree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sun, 23 Nov 2014 17:45:18 +0100 (CET)
From:	Julia Lawall <julia.lawall@...6.fr>
To:	Konstantin Khlebnikov <koct9i@...il.com>
cc:	Julia Lawall <julia.lawall@...6.fr>,
	Konstantin Khlebnikov <k.khlebnikov@...sung.com>,
	kexec@...ts.infradead.org,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Eric Biederman <ebiederm@...ssion.com>,
	Michal Marek <mmarek@...e.cz>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	Gilles Muller <Gilles.Muller@...6.fr>,
	Nicolas Palix <nicolas.palix@...g.fr>,
	linux-crypto@...r.kernel.org,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: [PATCH 1/2 v2] scripts/coccinelle: catch freeing cryptographic
 structures via kfree



On Wed, 19 Nov 2014, Konstantin Khlebnikov wrote:

> On Wed, Nov 19, 2014 at 12:41 PM, Julia Lawall <julia.lawall@...6.fr> wrote:
> >> +// Comments: There are false positives in crypto/ where they are
> >> actually freed.
> >
> > I didn't really understand this comment.  I ran the semantic patch and got
> > around 10 results, but it wasn't clear to me how to see which were false
> > positives.
> 
> I mean false positives in code inside directory crypto/ where this
> subsystem lives.
> 
> ./arch/x86/crypto/fpu.c:143:1-6: WARNING: invalid free of
> crypto_alloc_* allocated data
> ./crypto/algapi.c:846:1-6: WARNING: invalid free of crypto_alloc_*
> allocated data
> ./crypto/lrw.c:378:1-6: WARNING: invalid free of crypto_alloc_* allocated data
> ./crypto/ecb.c:163:1-6: WARNING: invalid free of crypto_alloc_* allocated data
> ./crypto/ctr.c:242:1-6: WARNING: invalid free of crypto_alloc_* allocated data
> ./crypto/ctr.c:419:1-6: WARNING: invalid free of crypto_alloc_* allocated data
> ./crypto/ctr.c:428:1-6: WARNING: invalid free of crypto_alloc_* allocated data
> ./crypto/pcbc.c:273:1-6: WARNING: invalid free of crypto_alloc_* allocated data
> ./crypto/cts.c:329:1-6: WARNING: invalid free of crypto_alloc_* allocated data
> ./crypto/cbc.c:267:1-6: WARNING: invalid free of crypto_alloc_* allocated data
> ./crypto/xts.c:340:1-6: WARNING: invalid free of crypto_alloc_* allocated data
> 
> This is kfree calls on error paths in constructors or in destructors
> which actually frees memory when crypto_free_* is called.

Sorry, but I am not sure to fully understand the issue.  Is it actually 
just the case that crypto_alloc_instance and crypto_alloc_instance2 should 
not be in the list of allocation functions, because their results should 
be freed with kfree?

julia


> 
> >
> > I would suggest to extend the rule a little bit to include information
> > about where the allocation call is:
> 
> Not sure if this is necessary. This part of crypto-api is simple.
> 
> >
> > ///
> > /// Structures allocated by crypto_alloc_* must be freed using crypto_free_*.
> > /// This finds freeing them by kfree.
> > ///
> > // Confidence: Moderate
> > // Copyright: (C) 2014 Konstantin Khlebnikov,  GPLv2.
> > // Comments: There are false positives in crypto/ where they are actually freed.
> > // Keywords: crypto, kfree
> > // Options: --no-includes --include-headers
> >
> > virtual org
> > virtual report
> > virtual context
> >
> > @r depends on context || org || report@
> > expression x;
> > position p1;
> > @@
> >
> > (
> >  x = crypto_alloc_base@p1(...)
> > |
> >  x = crypto_alloc_cipher@p1(...)
> > |
> >  x = crypto_alloc_ablkcipher@p1(...)
> > |
> >  x = crypto_alloc_aead@p1(...)
> > |
> >  x = crypto_alloc_instance@p1(...)
> > |
> >  x = crypto_alloc_instance2@p1(...)
> > |
> >  x = crypto_alloc_comp@p1(...)
> > |
> >  x = crypto_alloc_pcomp@p1(...)
> > |
> >  x = crypto_alloc_hash@p1(...)
> > |
> >  x = crypto_alloc_ahash@p1(...)
> > |
> >  x = crypto_alloc_shash@p1(...)
> > |
> >  x = crypto_alloc_rng@p1(...)
> > )
> >
> > @pb@
> > expression r.x;
> > position p;
> > @@
> >
> > * kfree@p(x)
> >
> > @script:python depends on org@
> > p << pb.p;
> > p1 << r.p1;
> > @@
> >
> > msg="WARNING: invalid free of crypto_alloc_* allocated data"
> > coccilib.org.print_todo(p[0], msg)
> > coccilib.org.print_link(p1[0], "allocation")
> >
> > @script:python depends on report@
> > p << pb.p;
> > p1 << r.p1;
> > @@
> >
> > msg="WARNING: invalid free of crypto_alloc_* allocated data, allocated on line %s" % (p1[0].line)
> > coccilib.report.print_report(p[0], msg)
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> > the body of a message to majordomo@...r.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> > Please read the FAQ at  http://www.tux.org/lkml/
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/