Description
In the Linux kernel, the following vulnerability has been resolved: blk-crypto: make blk_crypto_evict_key() more robust If blk_crypto_evict_key() sees that the key is still in-use (due to a bug) or that ->keyslot_evict failed, it currently just returns while leaving the key linked into the keyslot management structures. However, blk_crypto_evict_key() is only called in contexts such as inode eviction where failure is not an option. So actually the caller proceeds with freeing the blk_crypto_key regardless of the return value of blk_crypto_evict_key(). These two assumptions don't match, and the result is that there can be a use-after-free in blk_crypto_reprogram_all_keys() after one of these errors occurs. (Note, these errors *shouldn't* happen; we're just talking about what happens if they do anyway.) Fix this by making blk_crypto_evict_key() unlink the key from the keyslot management structures even on failure. Also improve some comments.
Product status
1b2628397058ebce7277480960b29c788138de90 before 701a8220762ff90615dc91d3543f789391b63298
1b2628397058ebce7277480960b29c788138de90 before 5bb4005fb667c6e2188fa87950f8d5faf2994410
1b2628397058ebce7277480960b29c788138de90 before 64ef787bb1588475163069c2e62fdd8f6c27b1f6
1b2628397058ebce7277480960b29c788138de90 before 809a5be62e92a444a3c3d7b9f438019d0b322f55
1b2628397058ebce7277480960b29c788138de90 before 5c62852942667c613de0458fc797c5b8c36112b5
1b2628397058ebce7277480960b29c788138de90 before 5c7cb94452901a93e90c2230632e2c12a681bc92
5.8
Any version before 5.8
5.10.180
5.15.111
6.1.28
6.2.15
6.3.2
6.4
References
git.kernel.org/...c/701a8220762ff90615dc91d3543f789391b63298
git.kernel.org/...c/5bb4005fb667c6e2188fa87950f8d5faf2994410
git.kernel.org/...c/64ef787bb1588475163069c2e62fdd8f6c27b1f6
git.kernel.org/...c/809a5be62e92a444a3c3d7b9f438019d0b322f55
git.kernel.org/...c/5c62852942667c613de0458fc797c5b8c36112b5
git.kernel.org/...c/5c7cb94452901a93e90c2230632e2c12a681bc92
