On Fri, 2016-03-18 at 22:42 +0800, Herbert Xu wrote:
> This bug has already bee fixed upstream since 4.2.  However, it
> was fixed during the AEAD conversion so no fix was backported to
> the older kernels.
> 
> When we do an RFC 4543 decryption, we will end up writing the
> ICV beyond the end of the dst buffer.  This should lead to a
> crash but for some reason it was never noticed.
> 
> This patch fixes it by only writing back the ICV for encryption.
> 
> Fixes: d733ac90f9fe ("crypto: gcm - fix rfc4543 to handle async...")
> Reported-by: Patrick Meyer <patrick.meyer@vasgard.com>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Queued up for 3.16, thanks.

Ben.

> 
> diff --git a/crypto/gcm.c b/crypto/gcm.c
> index b4c2520..cd97cdd 100644
> --- a/crypto/gcm.c
> +++ b/crypto/gcm.c
> @@ -1173,6 +1173,9 @@ static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req,
>  	aead_request_set_tfm(subreq, ctx->child);
>  	aead_request_set_callback(subreq, req->base.flags, crypto_rfc4543_done,
>  				  req);
> +	if (!enc)
> +		aead_request_set_callback(subreq, req->base.flags,
> +					  req->base.complete, req->base.data);
>  	aead_request_set_crypt(subreq, cipher, cipher, enc ? 0 : authsize, iv);
>  	aead_request_set_assoc(subreq, assoc, assoclen);
>  
-- 
Ben Hutchings
The generation of random numbers is too important to be left to chance.
                                                            - Robert Coveyou