* [PATCH v2] crypto: AF_ALG - fix AEAD AIO handling of zero buffer
@ 2016-12-01 7:22 Stephan Mueller
2016-12-01 13:22 ` Herbert Xu
0 siblings, 1 reply; 3+ messages in thread
From: Stephan Mueller @ 2016-12-01 7:22 UTC (permalink / raw)
To: herbert; +Cc: linux-crypto
Hi Herbert,
I split out the bug fix patch from the AD/tag formatting patch as they most likely will come after the next merge window.
---8<---
Handle the case when the caller provided a zero buffer to
sendmsg/sendpage. Such scenario is legal for AEAD ciphers when no
plaintext / ciphertext and no AAD is provided and the caller only
requests the generation of the tag value.
Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
crypto/algif_aead.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 80a0f1a..6e95137 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -448,12 +448,13 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
used -= ctx->aead_assoclen + (ctx->enc ? as : 0);
/* take over all tx sgls from ctx */
- areq->tsgl = sock_kmalloc(sk, sizeof(*areq->tsgl) * sgl->cur,
+ areq->tsgl = sock_kmalloc(sk,
+ sizeof(*areq->tsgl) * max_t(u32, sgl->cur, 1),
GFP_KERNEL);
if (unlikely(!areq->tsgl))
goto free;
- sg_init_table(areq->tsgl, sgl->cur);
+ sg_init_table(areq->tsgl, max_t(u32, sgl->cur, 1));
for (i = 0; i < sgl->cur; i++)
sg_set_page(&areq->tsgl[i], sg_page(&sgl->sg[i]),
sgl->sg[i].length, sgl->sg[i].offset);
--
2.9.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] crypto: AF_ALG - fix AEAD AIO handling of zero buffer
2016-12-01 7:22 [PATCH v2] crypto: AF_ALG - fix AEAD AIO handling of zero buffer Stephan Mueller
@ 2016-12-01 13:22 ` Herbert Xu
2016-12-07 12:29 ` Stephan Müller
0 siblings, 1 reply; 3+ messages in thread
From: Herbert Xu @ 2016-12-01 13:22 UTC (permalink / raw)
To: Stephan Mueller; +Cc: linux-crypto
On Thu, Dec 01, 2016 at 08:22:37AM +0100, Stephan Mueller wrote:
> Hi Herbert,
>
> I split out the bug fix patch from the AD/tag formatting patch as they most likely will come after the next merge window.
>
> ---8<---
>
> Handle the case when the caller provided a zero buffer to
> sendmsg/sendpage. Such scenario is legal for AEAD ciphers when no
> plaintext / ciphertext and no AAD is provided and the caller only
> requests the generation of the tag value.
>
> Signed-off-by: Stephan Mueller <smueller@chronox.de>
Patch applied. Thanks.
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] crypto: AF_ALG - fix AEAD AIO handling of zero buffer
2016-12-01 13:22 ` Herbert Xu
@ 2016-12-07 12:29 ` Stephan Müller
0 siblings, 0 replies; 3+ messages in thread
From: Stephan Müller @ 2016-12-07 12:29 UTC (permalink / raw)
To: Herbert Xu; +Cc: linux-crypto
Am Donnerstag, 1. Dezember 2016, 21:22:07 CET schrieb Herbert Xu:
Hi Herbert,
> On Thu, Dec 01, 2016 at 08:22:37AM +0100, Stephan Mueller wrote:
> > Hi Herbert,
> >
> > I split out the bug fix patch from the AD/tag formatting patch as they
> > most likely will come after the next merge window.
> >
> > ---8<---
> >
> > Handle the case when the caller provided a zero buffer to
> > sendmsg/sendpage. Such scenario is legal for AEAD ciphers when no
> > plaintext / ciphertext and no AAD is provided and the caller only
> > requests the generation of the tag value.
> >
> > Signed-off-by: Stephan Mueller <smueller@chronox.de>
>
> Patch applied. Thanks.
May I suggest to forward that patch to stable as this patch fixes a kernel
crasher that can be triggered by an unprivileged user?
The bug was introduced in 4.7 with the AEAD AIO addition.
Ciao
Stephan
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-12-07 12:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-12-01 7:22 [PATCH v2] crypto: AF_ALG - fix AEAD AIO handling of zero buffer Stephan Mueller
2016-12-01 13:22 ` Herbert Xu
2016-12-07 12:29 ` Stephan Müller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox