From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:36730 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932938AbcFLVfz (ORCPT ); Sun, 12 Jun 2016 17:35:55 -0400 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Herbert Xu" , "Patrick Meyer" , "Greg Kroah-Hartman" Date: Sun, 12 Jun 2016 22:34:41 +0100 Message-ID: Subject: [PATCH 3.2 06/46] crypto: gcm - Fix rfc4543 decryption crash In-Reply-To: Sender: stable-owner@vger.kernel.org List-ID: 3.2.81-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Herbert Xu This bug has already bee fixed upstream since 4.2. However, it was fixed during the AEAD conversion so no fix was backported to the older kernels. When we do an RFC 4543 decryption, we will end up writing the ICV beyond the end of the dst buffer. This should lead to a crash but for some reason it was never noticed. This patch fixes it by only writing back the ICV for encryption. Fixes: d733ac90f9fe ("crypto: gcm - fix rfc4543 to handle async...") Reported-by: Patrick Meyer Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman Signed-off-by: Ben Hutchings --- crypto/gcm.c | 3 +++ 1 file changed, 3 insertions(+) --- a/crypto/gcm.c +++ b/crypto/gcm.c @@ -1176,6 +1176,9 @@ static struct aead_request *crypto_rfc45 aead_request_set_tfm(subreq, ctx->child); aead_request_set_callback(subreq, req->base.flags, crypto_rfc4543_done, req); + if (!enc) + aead_request_set_callback(subreq, req->base.flags, + req->base.complete, req->base.data); aead_request_set_crypt(subreq, cipher, cipher, enc ? 0 : authsize, iv); aead_request_set_assoc(subreq, assoc, assoclen);