From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS, T_DKIMWL_WL_HIGH,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5665C43219 for ; Sat, 4 May 2019 10:27:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 784EE20859 for ; Sat, 4 May 2019 10:27:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1556965650; bh=oyxowGJZUWZSwIngobzJpxJkdNTsS5uLUzAv/L0Q1vE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=07B8+mrrjFy1Z3anCmE0mboKuvHackioHwdMoVKMDfN5bA7gG2qlssjPOJTquaeWr x9UzX77OmaP4IaxhfLkENkyKZmFwcBX/rRZAHy54dcCbuVsx8DCuBedh6T0YpkuK3J gjlKJli8a0qP0o7hP4zDgQ8XXDQv+JY2dw8hOMsk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728191AbfEDK13 (ORCPT ); Sat, 4 May 2019 06:27:29 -0400 Received: from mail.kernel.org ([198.145.29.99]:37598 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728156AbfEDK10 (ORCPT ); Sat, 4 May 2019 06:27:26 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id F153B20859; Sat, 4 May 2019 10:27:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1556965645; bh=oyxowGJZUWZSwIngobzJpxJkdNTsS5uLUzAv/L0Q1vE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rsLLW8FcjmEjJ6LfwxY4UqVyijJneLjTgIRN8FUWkpFmGmfnEDCNHW1G7LxNEgILU umRBgfwN1iFaRSH2a+U1yNeknyxQqZmGBs6R7pJxfY8aTLhRsqIeg9DF1nTXJU4YEO Grb/3/42an8mee2Rd9lwAnWbijzbc5ilfnIXGjuY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jakub Kicinski , John Hurley , "David S. Miller" Subject: [PATCH 4.19 18/23] net/tls: dont copy negative amounts of data in reencrypt Date: Sat, 4 May 2019 12:25:20 +0200 Message-Id: <20190504102452.122933007@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190504102451.512405835@linuxfoundation.org> References: <20190504102451.512405835@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jakub Kicinski [ Upstream commit 97e1caa517e22d62a283b876fb8aa5f4672c83dd ] There is no guarantee the record starts before the skb frags. If we don't check for this condition copy amount will get negative, leading to reads and writes to random memory locations. Familiar hilarity ensues. Fixes: 4799ac81e52a ("tls: Add rx inline crypto offload") Signed-off-by: Jakub Kicinski Reviewed-by: John Hurley Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/tls/tls_device.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) --- a/net/tls/tls_device.c +++ b/net/tls/tls_device.c @@ -600,14 +600,16 @@ static int tls_device_reencrypt(struct s else err = 0; - copy = min_t(int, skb_pagelen(skb) - offset, - rxm->full_len - TLS_CIPHER_AES_GCM_128_TAG_SIZE); + if (skb_pagelen(skb) > offset) { + copy = min_t(int, skb_pagelen(skb) - offset, + rxm->full_len - TLS_CIPHER_AES_GCM_128_TAG_SIZE); - if (skb->decrypted) - skb_store_bits(skb, offset, buf, copy); + if (skb->decrypted) + skb_store_bits(skb, offset, buf, copy); - offset += copy; - buf += copy; + offset += copy; + buf += copy; + } skb_walk_frags(skb, skb_iter) { copy = min_t(int, skb_iter->len,