lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <ZRvyysCUTqA7aXN4@work> Date: Tue, 3 Oct 2023 12:54:02 +0200 From: "Gustavo A. R. Silva" <gustavoars@...nel.org> To: Ayush Sawal <ayush.sawal@...lsio.com>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Rohit Maheshwari <rohitm@...lsio.com> Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org, "Gustavo A. R. Silva" <gustavoars@...nel.org>, linux-hardening@...r.kernel.org Subject: [PATCH][next] cxgb4/ch_ktls: Fix undefined behavior bug in struct chcr_ktls_ofld_ctx_tx `struct tls_offload_context_tx` is a flexible structure, which means that it contains a flexible-array member at the bottom. This could potentially lead to an overwrite of the objects following `base` in `struct chcr_ktls_ofld_ctx_tx` at run-time. Notice that flexible-array member `driver_state` in `struct tls_offload_context_tx` can grow up to 16 bytes at run-time: | include/net/tls.h-170: | #define TLS_DRIVER_STATE_SIZE_TX 16 | include/net/tls.h-173: | #define TLS_OFFLOAD_CONTEXT_SIZE_TX \ | (sizeof(struct tls_offload_context_tx) + TLS_DRIVER_STATE_SIZE_TX) | net/tls/tls_device.c-1119: | offload_ctx = kzalloc(TLS_OFFLOAD_CONTEXT_SIZE_TX, GFP_KERNEL); Fix this by placing the declaration of object `base` at the end of `struct chcr_ktls_ofld_ctx_tx`. Fixes: 34aba2c45024 ("cxgb4/chcr : Register to tls add and del callback") Cc: stable@...r.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavoars@...nel.org> --- drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.h b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.h index 10572dc55365..35e34e3db663 100644 --- a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.h +++ b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.h @@ -68,8 +68,8 @@ struct chcr_ktls_info { }; struct chcr_ktls_ofld_ctx_tx { - struct tls_offload_context_tx base; struct chcr_ktls_info *chcr_info; + struct tls_offload_context_tx base; }; struct chcr_ktls_uld_ctx { -- 2.34.1
Powered by blists - more mailing lists