linux-kernel - Re: crypto: slab-out-of-bounds in skcipher

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACT4Y+Zr02Jnv-DZUyg_Cx5rBHmzDM=NjLBb7CApJattcS4J9g@mail.gmail.com>
Date:	Mon, 18 Jan 2016 16:06:39 +0100
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	Herbert Xu <herbert@...dor.apana.org.au>
Cc:	"David S. Miller" <davem@...emloft.net>,
	linux-crypto@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>,
	syzkaller <syzkaller@...glegroups.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Eric Dumazet <edumazet@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>
Subject: Re: crypto: slab-out-of-bounds in skcipher_recvmsg

On Mon, Jan 18, 2016 at 11:46 AM, Herbert Xu
<herbert@...dor.apana.org.au> wrote:
> On Fri, Jan 15, 2016 at 07:22:04PM +0100, Dmitry Vyukov wrote:
>> Hello,
>>
>> The following program causes slab-out-of-bounds in skcipher_recvmsg:
>
> Thanks for the report.  This patch should fix it.


Fixes the issue for me. Thanks!

Tested-by: Dmitry Vyukov <dvyukov@...gle.com>


> ---8<---
> Subject: crypto: algif_skcipher - Load TX SG list after waiting
>
> We need to load the TX SG list in sendmsg(2) after waiting for
> incoming data, not before.
>
> Cc: stable@...r.kernel.org
> Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
> Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>
>
> diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
> index dfff8b0..df86fb4 100644
> --- a/crypto/algif_skcipher.c
> +++ b/crypto/algif_skcipher.c
> @@ -647,13 +647,6 @@ static int skcipher_recvmsg_sync(struct socket *sock, struct msghdr *msg,
>
>         lock_sock(sk);
>         while (msg_data_left(msg)) {
> -               sgl = list_first_entry(&ctx->tsgl,
> -                                      struct skcipher_sg_list, list);
> -               sg = sgl->sg;
> -
> -               while (!sg->length)
> -                       sg++;
> -
>                 if (!ctx->used) {
>                         err = skcipher_wait_for_data(sk, flags);
>                         if (err)
> @@ -674,6 +667,13 @@ static int skcipher_recvmsg_sync(struct socket *sock, struct msghdr *msg,
>                 if (!used)
>                         goto free;
>
> +               sgl = list_first_entry(&ctx->tsgl,
> +                                      struct skcipher_sg_list, list);
> +               sg = sgl->sg;
> +
> +               while (!sg->length)
> +                       sg++;
> +
>                 skcipher_request_set_crypt(&ctx->req, sg, ctx->rsgl.sg, used,
>                                            ctx->iv);
>
> --
> Email: Herbert Xu <herbert@...dor.apana.org.au>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt