Stable kernel blocks IV race in userspace skcipher sockets

A race in the Linux kernel's AF_ALG skcipher interface let an unprivileged local user overwrite the initialization vector of an in-flight cipher request, enabling keystream reuse and recovery of plaintext from a concurrent operation on the same socket.

The asynchronous path used for AIO receives handed the socket-wide IV straight into the crypto request. Once the receive was queued, the socket lock was dropped and a worker processed the request later. In that window a concurrent ALG_SET_IV call could replace the IV, so the operation ran under attacker-controlled material. For CTR and other stream modes the result is IV and keystream reuse, which breaks confidentiality.

Snapshotting the IV into per-request memory would have fixed the race but broken MSG_MORE chaining for ciphers that carry no separate state and rely on in-place IV writeback, including CBC and CTR. Writing the IV back from a completion callback was also ruled out: the callback can run in softirq context and must not take the socket lock. The fix therefore forces the receive path to run synchronously. The IV is touched only while the socket lock is held, the race is gone, and existing chaining behavior is preserved.

Muhammet Kaan Kılınç wrote the change. Greg Kroah-Hartman has queued it for the 7.1 stable series; it produces the same end state already present on mainline after AIO support was removed from sockets entirely.