From: Stephan Mueller <smueller@chronox.de>
To: Mathias Krause <minipli@googlemail.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
linux-crypto@vger.kernel.org,
Steffen Klassert <steffen.klassert@secunet.com>
Subject: Re: [PATCH] crypto: user - re-add size check for CRYPTO_MSG_GETALG
Date: Wed, 22 Jun 2016 21:03:19 +0200 [thread overview]
Message-ID: <1700839.z4KCsoVT9C@positron.chronox.de> (raw)
In-Reply-To: <1466620177-10998-1-git-send-email-minipli@googlemail.com>
Am Mittwoch, 22. Juni 2016, 20:29:37 schrieb Mathias Krause:
Hi Mathias,
> Commit 9aa867e46565 ("crypto: user - Add CRYPTO_MSG_DELRNG")
> accidentally removed the minimum size check for CRYPTO_MSG_GETALG
> netlink messages. This allows userland to send a truncated
> CRYPTO_MSG_GETALG message as short as a netlink header only making
> crypto_report() operate on uninitialized memory by accessing data
> beyond the end of the netlink message.
>
> Fix this be re-adding the minimum required size of CRYPTO_MSG_GETALG
> messages to the crypto_msg_min[] array.
I was playing with the adding of the GETALG value as you did to track down the
issue fixed with eed1e1afd8d542d9644534c1b712599b5d680007 ("crypto: user - no
parsing of CRYPTO_MSG_GETALG") in the cryptodev-2.6 tree.
It did not occur to me that it fixes another bug. Yet, with this addition, it
would be possible to revert the patch eed1e1afd8d542d9644534c1b712599b5d680007
as your patch fixes the issue too. But my fix can also stay as it does not
hurt either.
What is your take on that?
Ciao
Stephan
next prev parent reply other threads:[~2016-06-22 19:03 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-22 18:29 [PATCH] crypto: user - re-add size check for CRYPTO_MSG_GETALG Mathias Krause
2016-06-22 19:03 ` Stephan Mueller [this message]
2016-06-22 19:43 ` Mathias Krause
2016-06-23 10:43 ` Herbert Xu
2016-06-23 14:46 ` Stephan Mueller
2016-06-24 1:00 ` Herbert Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1700839.z4KCsoVT9C@positron.chronox.de \
--to=smueller@chronox.de \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=linux-crypto@vger.kernel.org \
--cc=minipli@googlemail.com \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox