From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS, T_DKIMWL_WL_HIGH,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4611AC43219 for ; Sat, 4 May 2019 10:26:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 075D72085A for ; Sat, 4 May 2019 10:26:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1556965588; bh=K4R6WH1m108Q8qjtdhaEEwfLxxwWzDC5/gUn77zrxtQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=SwIvLHOnY0peiWHnnmD10CjgK+7BhXO6kVUlqh7CH/l65LTqZ5LuhSvM0+kuyeyTl BVhm9Ffq+whDZTXCpRee6Kt9J6bFkbA9qoXJlVjzCYkcgvCNauONkHAsicDzovWr1q D35qWdHdBCDpwDJgG03b0VSJxRIHeBZXgBeVCWEw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727719AbfEDK00 (ORCPT ); Sat, 4 May 2019 06:26:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:35932 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727694AbfEDK0X (ORCPT ); Sat, 4 May 2019 06:26:23 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3E80D2084A; Sat, 4 May 2019 10:26:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1556965582; bh=K4R6WH1m108Q8qjtdhaEEwfLxxwWzDC5/gUn77zrxtQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iPSI6dk7OS/lSKyJ9h3Zi9Jtq9GFfhfRAM/vNN4RLtHV0OP/IS98WpGP3zywRfsrW 2kkWnRkIalC9qtgk7kuFhsj6TUyPyo4o6+nuGPN959vG57pDdoGs6wALqeqXzDrfgG qPrxlyCKP1Ue6RTS7xAuMdM4T1+LaBctluBPMbig= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jakub Kicinski , John Hurley , "David S. Miller" Subject: [PATCH 5.0 26/32] net/tls: dont copy negative amounts of data in reencrypt Date: Sat, 4 May 2019 12:25:11 +0200 Message-Id: <20190504102453.291848347@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190504102452.523724210@linuxfoundation.org> References: <20190504102452.523724210@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jakub Kicinski [ Upstream commit 97e1caa517e22d62a283b876fb8aa5f4672c83dd ] There is no guarantee the record starts before the skb frags. If we don't check for this condition copy amount will get negative, leading to reads and writes to random memory locations. Familiar hilarity ensues. Fixes: 4799ac81e52a ("tls: Add rx inline crypto offload") Signed-off-by: Jakub Kicinski Reviewed-by: John Hurley Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/tls/tls_device.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) --- a/net/tls/tls_device.c +++ b/net/tls/tls_device.c @@ -610,14 +610,16 @@ static int tls_device_reencrypt(struct s else err = 0; - copy = min_t(int, skb_pagelen(skb) - offset, - rxm->full_len - TLS_CIPHER_AES_GCM_128_TAG_SIZE); + if (skb_pagelen(skb) > offset) { + copy = min_t(int, skb_pagelen(skb) - offset, + rxm->full_len - TLS_CIPHER_AES_GCM_128_TAG_SIZE); - if (skb->decrypted) - skb_store_bits(skb, offset, buf, copy); + if (skb->decrypted) + skb_store_bits(skb, offset, buf, copy); - offset += copy; - buf += copy; + offset += copy; + buf += copy; + } skb_walk_frags(skb, skb_iter) { copy = min_t(int, skb_iter->len,