In the Linux kernel, the following vulnerability has been resolved:
padata: fix UAF in padata_reorder
A bug was found when run ltp test:
BUG: KASAN: slab-use-after-free in padatafindnext+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206
CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecryptparallel padataparallelworker Call Trace: <TASK> dumpstacklvl+0x32/0x50 printaddressdescription.constprop.0+0x6b/0x3d0 printreport+0xdd/0x2c0 kasanreport+0xa5/0xd0 padatafindnext+0x29/0x1a0 padatareorder+0x131/0x220 padataparallelworker+0x3d/0xc0 processonework+0x2ec/0x5a0
If 'mdelay(10)' is added before calling 'padatafindnext' in the 'padatareorder' function, this issue could be reproduced easily with ltp test (pcryptaead01).
This can be explained as bellow:
pcryptaeadencrypt ... padatadoparallel refcountinc(&pd->refcnt); // add refcnt ... padatadoserial padatareorder // pd while (1) { padatafindnext(pd, true); // using pd queueworkon ... padataserialworker cryptodelalg padataputpdcnt // sub refcnt padatafreeshell padataputpd(ps->pd); // pd is freed // loop again, but pd is freed // call padatafind_next, UAF }
In the padatareorder function, when it loops in 'while', if the alg is deleted, the refcnt may be decreased to 0 before entering 'padatafind_next', which leads to UAF.
As mentioned in [1], doserial is supposed to be called with BHs disabled and always happen under RCU protection, to address this issue, add synchronizercu() in 'padatafreeshell' wait for all doserial calls to finish.
[1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.localdomain/ [2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofeiczqmqs2m7o6@fq426cwnjtkm/
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e01780ea4661172734118d2a5f41bc9720765668",
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-0a5c9ee5",
"digest": {
"length": 263.0,
"function_hash": "132796331311552639916707676352591685703"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e0b9f790f8e8065d59e67b565a83154d9f3079",
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-1587a0a2",
"digest": {
"length": 299.0,
"function_hash": "139159946710589049173572235352277219649"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@573ac9c70bf7885dc85d82fa44550581bfc3b738",
"target": {
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-370bc919",
"digest": {
"threshold": 0.9,
"line_hashes": [
"281886909196179248990040402245994106648",
"313203998478253391509443594594670120053",
"212999120267957035217387923905406877032"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ae2f332cfd2d74cf3ce344ec9938cf3e29c3ccd",
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-59066731",
"digest": {
"length": 299.0,
"function_hash": "139159946710589049173572235352277219649"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f78170bee51469734b1a306a74fc5f777bb22ba6",
"target": {
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-6557665a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"281886909196179248990040402245994106648",
"313203998478253391509443594594670120053",
"212999120267957035217387923905406877032"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbccae982e9fa1d7abcb23a5ec81cb0ec883f7de",
"target": {
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-7e8671da",
"digest": {
"threshold": 0.9,
"line_hashes": [
"281886909196179248990040402245994106648",
"313203998478253391509443594594670120053",
"212999120267957035217387923905406877032"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f78170bee51469734b1a306a74fc5f777bb22ba6",
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-8615b53a",
"digest": {
"length": 299.0,
"function_hash": "139159946710589049173572235352277219649"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80231f069240d52e98b6a317456c67b2eafd0781",
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-8798aff8",
"digest": {
"length": 299.0,
"function_hash": "139159946710589049173572235352277219649"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e01780ea4661172734118d2a5f41bc9720765668",
"target": {
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-9566368b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"281886909196179248990040402245994106648",
"313203998478253391509443594594670120053",
"212999120267957035217387923905406877032"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80231f069240d52e98b6a317456c67b2eafd0781",
"target": {
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-c18880ca",
"digest": {
"threshold": 0.9,
"line_hashes": [
"281886909196179248990040402245994106648",
"313203998478253391509443594594670120053",
"212999120267957035217387923905406877032"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@573ac9c70bf7885dc85d82fa44550581bfc3b738",
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-e7e90f4e",
"digest": {
"length": 299.0,
"function_hash": "139159946710589049173572235352277219649"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbccae982e9fa1d7abcb23a5ec81cb0ec883f7de",
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-e851df8a",
"digest": {
"length": 299.0,
"function_hash": "139159946710589049173572235352277219649"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e0b9f790f8e8065d59e67b565a83154d9f3079",
"target": {
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-fda505cd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"281886909196179248990040402245994106648",
"313203998478253391509443594594670120053",
"212999120267957035217387923905406877032"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ae2f332cfd2d74cf3ce344ec9938cf3e29c3ccd",
"target": {
"file": "kernel/padata.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-21727-fe3bc8ac",
"digest": {
"threshold": 0.9,
"line_hashes": [
"281886909196179248990040402245994106648",
"313203998478253391509443594594670120053",
"212999120267957035217387923905406877032"
]
},
"signature_type": "Line"
}
]