lkml.org 
[lkml]   [2018]   [Feb]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 009/156] crypto: aesni - handle zero length dst buffer
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Stephan Mueller <smueller@chronox.de>

    commit 9c674e1e2f9e24fa4392167efe343749008338e0 upstream.

    GCM can be invoked with a zero destination buffer. This is possible if
    the AAD and the ciphertext have zero lengths and only the tag exists in
    the source buffer (i.e. a source buffer cannot be zero). In this case,
    the GCM cipher only performs the authentication and no decryption
    operation.

    When the destination buffer has zero length, it is possible that no page
    is mapped to the SG pointing to the destination. In this case,
    sg_page(req->dst) is an invalid access. Therefore, page accesses should
    only be allowed if the req->dst->length is non-zero which is the
    indicator that a page must exist.

    This fixes a crash that can be triggered by user space via AF_ALG.

    Signed-off-by: Stephan Mueller <smueller@chronox.de>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/x86/crypto/aesni-intel_glue.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/arch/x86/crypto/aesni-intel_glue.c
    +++ b/arch/x86/crypto/aesni-intel_glue.c
    @@ -823,7 +823,7 @@ static int gcmaes_decrypt(struct aead_re
    if (sg_is_last(req->src) &&
    (!PageHighMem(sg_page(req->src)) ||
    req->src->offset + req->src->length <= PAGE_SIZE) &&
    - sg_is_last(req->dst) &&
    + sg_is_last(req->dst) && req->dst->length &&
    (!PageHighMem(sg_page(req->dst)) ||
    req->dst->offset + req->dst->length <= PAGE_SIZE)) {
    one_entry_in_sg = 1;

    \
     
     \ /
      Last update: 2018-02-02 18:15    [W:3.944 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site