linux-kernel - [PATCH] lib/mpi: Fix kernel unaligned acces in mpi_write_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160421110736.GL22060@oracle.com>
Date:	Thu, 21 Apr 2016 07:07:36 -0400
From:	Sowmini Varadhan <sowmini.varadhan@...cle.com>
To:	sowmini.varadhan@...cle.com, tadeusz.struk@...el.com,
	linux-kernel@...r.kernel.org
Cc:	herbert@...dor.apana.org.au, smueller@...onox.de, mmarek@...e.com,
	arnd@...db.de, andrew.zaborowski@...el.com
Subject: [PATCH] lib/mpi: Fix kernel unaligned acces in mpi_write_to_sgl


Commit 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") added
mpi_write_to_sgl() which generates traps due to unaligned
access on some platforms like sparc. Fix this by using
the get_unaligned* and put_unaligned* functions.

Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers")
Signed-off-by: Sowmini Varadhan <sowmini.varadhan@...cle.com>
---
 lib/mpi/mpicoder.c |   12 ++++++++----
 1 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index eb15e7d..6771378 100644
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -21,6 +21,7 @@
 #include <linux/bitops.h>
 #include <linux/count_zeros.h>
 #include "mpi-internal.h"
+#include <asm/unaligned.h>
 
 #define MAX_EXTERN_MPI_BITS 16384
 
@@ -405,10 +406,13 @@ int mpi_write_to_sgl(MPI a, struct scatterlist *sgl, unsigned *nbytes,
 				p -= sizeof(alimb);
 				continue;
 			} else {
-				mpi_limb_t *limb1 = (void *)p - sizeof(alimb);
-				mpi_limb_t *limb2 = (void *)p - sizeof(alimb)
-							+ lzeros;
-				*limb1 = *limb2;
+				mpi_limb_t tmp;
+
+				tmp = get_unaligned_be32((void *)p -
+							 sizeof(alimb) +
+							 lzeros);
+				put_unaligned_be32(tmp,
+						   (void *)p - sizeof(alimb));
 				p -= lzeros;
 				y = lzeros;
 			}
-- 
1.7.1