netdev - Re: [RFC XFRM]: esp: fix scatterlist of out bounds access with crypto

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 29 Apr 2008 07:09:39 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	Herbert Xu <herbert@...dor.apana.org.au>
CC:	linux-crypto@...r.kernel.org,
	Linux Netdev List <netdev@...r.kernel.org>
Subject: Re: [RFC XFRM]: esp: fix scatterlist of out bounds access with crypto_eseqiv

Herbert Xu wrote:
> Hi Patrick:
> 
> On Mon, Apr 28, 2008 at 08:55:21PM +0200, Patrick McHardy wrote:
>> I ran into occasional BUGs in scatterlist.h, which turned
>> out the be caused by accessing an uninitialized scatterlist
>> entry from eseqiv. I'm not sure whether this patch is correct
>> since I'm seeing invalid packets with and without this patch
>> (probably related to HIFN though) and I don't understand why
>> scatterwalk_sg_next() returns either a scatterlist or a
>> struct page dependant on the length, but at least it fixes
>> the BUG() for me :)
> 
> Can you attach the BUG output please?


I've attached two traces, the one from eseqiv and a similar
one from authenc (I've manually overriden eseqiv by chainiv
to test whether its responsible for the broken packets I was
seeing, which turned out to be the case. I'll look into that).


View attachment "eseqiv.oops" of type "text/plain" (2471 bytes)

View attachment "authenc.oops" of type "text/plain" (2343 bytes)