From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1D265C433B4 for ; Wed, 12 May 2021 18:46:47 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id BF59260FF2 for ; Wed, 12 May 2021 18:46:46 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org BF59260FF2 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:Message-Id:Date: Subject:Cc:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=wkC1ylRnnjpTCrs/K+NcELS9/sGiPSZ7kp4b0LxNlr0=; b=So7vL6hA6HHS73lQi7FT9mdEv il6InePFBrCui5tBAimM2+h8Amx890d/TnWIR3QZUXGTP3Z4d0Eqwy4Zek/5M2wf9vd9pwT7v5g2d p1cC57Gv/oxZQ6gpNhVvIEmw8GYHRbW4zmWzd3grmhlxMxd6Zc4TObk+DnHDXoj/eWjut1lbdHJc4 ETNrr6rDSfR3TC6qHluRYL0zJGfgpBhKO84AxdfP3WnFGmtB4zxhgx3vikVLApPQ1cdB1xH2na5CO A5qlJORCKurwGGLqea4vFa1HGBbFO3cTnkLmCRyzBK9N0kTCyf1NjdQrlllMUhd8s6YWY7ZldP74r z7wISHjZg==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lgtqv-003gmb-N2; Wed, 12 May 2021 18:45:02 +0000 Received: from bombadil.infradead.org ([2607:7c80:54:e::133]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lgtqn-003gkt-22 for linux-arm-kernel@desiato.infradead.org; Wed, 12 May 2021 18:44:54 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=bombadil.20210309; h=Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender :Reply-To:Content-Type:Content-ID:Content-Description; bh=sOTbqcYNQicPU54M47xArwAHkJgxMP2nPi5cRonicmc=; b=XMeQEilg9Fd9ovpXXjWxqTW9rK v5jSDw6C1LjJ3Nj112wZ7ZaDaMuiu4YVi4DTiuuO9xJOGWjlhU1VYaayPK1xDLshoPsSJ41cEW86u Q52GowIF8jeTYHNbxQuEq20yOGk27jsebzUr7Y+D2wOUPzL2ejLghyLYiDfLbuGQ0GcsejHrqhQot lsyBYyYor8VKD0kHThHLXNy5gkuK+QZypcvraf8VhXdcfVsi4nswHZhRo6rq1Qz9ZQSEDRl9TWQC8 qvESTBV9KFVtVR6wLdis6Tz/yL4TGx+PoW21BMRcghEwf0s/W0sufUzmOPlyhjFlyZYtCeRfUpxEm WLvrBhKA==; Received: from mail.kernel.org ([198.145.29.99]) by bombadil.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lgtqi-00AieF-AT for linux-arm-kernel@lists.infradead.org; Wed, 12 May 2021 18:44:51 +0000 Received: by mail.kernel.org (Postfix) with ESMTPSA id 38C246142C; Wed, 12 May 2021 18:44:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1620845087; bh=nX+u8lxMcY7ppjq3Y1KWiUaWS7k47IypQzIdfThldJY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QZBwbUFR6BeKWuuU3yrTGKJjp9SZjCtCsHvNGekQKHN648yAiOniUb/UmZCSUWmpH fz9tSm08KxZrQw7S1V4fa1Ksy62/LDXL/6yG2HsoV4BR1krrGm0msVa3yoH1wn9rzf xFb5bPGw8/MIBAvojju2Ge0OJTgoMe4ai8WflPWsG9F1Unedl28HYVFV+7GWpxPC38 bJ8ssetYd8HWccqztQjtSM5rC0FD8mPhl+4VHwcDxYySS4r9CUXafKtKsPlEMpTOsM I8SZZ6JqGLGaa3N5/i4eiB3kv1nlq/Y6eKI5Vv9Wm9zuw+6+ZItfH0PXas/EF3Ut37 lhOAZieEcOrkw== From: Ard Biesheuvel To: linux-crypto@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org, ebiggers@kernel.org, herbert@gondor.apana.org.au, will@kernel.org, kernel-team@android.com, Ard Biesheuvel Subject: [PATCH v3 1/7] crypto: handle zero sized AEAD inputs correctly Date: Wed, 12 May 2021 20:44:33 +0200 Message-Id: <20210512184439.8778-2-ardb@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20210512184439.8778-1-ardb@kernel.org> References: <20210512184439.8778-1-ardb@kernel.org> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210512_114448_415940_60D6B7C1 X-CRM114-Status: GOOD ( 11.31 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org There are corner cases where skcipher_walk_aead_[en|de]crypt() may be invoked with a zero sized input, which is not rejected by the walker code, but results in the skcipher_walk structure to not be fully initialized. This will leave stale values in its page and buffer members, which will be subsequently passed to kfree() or free_page() by skcipher_walk_done(), resulting in a crash if those routines fail to identify them as in valid inputs. Fix this by setting page and buffer to NULL even if the size of the input is zero. Signed-off-by: Ard Biesheuvel --- crypto/skcipher.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/skcipher.c b/crypto/skcipher.c index a15376245416..93fdacf49697 100644 --- a/crypto/skcipher.c +++ b/crypto/skcipher.c @@ -511,6 +511,8 @@ static int skcipher_walk_aead_common(struct skcipher_walk *walk, walk->nbytes = 0; walk->iv = req->iv; walk->oiv = req->iv; + walk->buffer = NULL; + walk->page = NULL; if (unlikely(!walk->total)) return 0; -- 2.20.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel