Messages in this thread | | | From | Jann Horn <> | Date | Wed, 22 Nov 2023 22:58:13 +0100 | Subject | Re: [PATCH net] tls: fix NULL deref on tls_sw_splice_eof() with empty record |
| |
On Wed, Nov 22, 2023 at 10:44 PM Jann Horn <jannh@google.com> wrote: > syzkaller discovered that if tls_sw_splice_eof() is executed as part of > sendfile() when the plaintext/ciphertext sk_msg are empty, the send path > gets confused because the empty ciphertext buffer does not have enough > space for the encryption overhead. This causes tls_push_record() to go on > the `split = true` path (which is only supposed to be used when interacting > with an attached BPF program), and then get further confused and hit the > tls_merge_open_record() path, which then assumes that there must be at > least one populated buffer element, leading to a NULL deref.
Ah, and in case you're looking for the corresponding syzkaller report, you can find that at <https://lore.kernel.org/all/000000000000347a250608e8a4d1@google.com/T/>.
| |