linux-kernel - [PATCH][next] tls: rx: Fix less than zero check on unsigned variable sz

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220730114027.142376-1-colin.i.king@gmail.com>
Date:   Sat, 30 Jul 2022 12:40:27 +0100
From:   Colin Ian King <colin.i.king@...il.com>
To:     Boris Pismenny <borisp@...dia.com>,
        John Fastabend <john.fastabend@...il.com>,
        Jakub Kicinski <kuba@...nel.org>,
        "David S . Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH][next] tls: rx: Fix less than zero check on unsigned variable sz

Variable sz is declared as an unsigned size_t and is being checked
for an less than zero error return on a call to tls_rx_msg_size.
Fix this by making sz an int.

Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser")
Signed-off-by: Colin Ian King <colin.i.king@...il.com>
---
 net/tls/tls_strp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c
index b945288c312e..2b9c42b8064c 100644
--- a/net/tls/tls_strp.c
+++ b/net/tls/tls_strp.c
@@ -187,7 +187,8 @@ static int tls_strp_copyin(read_descriptor_t *desc, struct sk_buff *in_skb,
 			   unsigned int offset, size_t in_len)
 {
 	struct tls_strparser *strp = (struct tls_strparser *)desc->arg.data;
-	size_t sz, len, chunk;
+	int sz;
+	size_t len, chunk;
 	struct sk_buff *skb;
 	skb_frag_t *frag;
 
@@ -215,7 +216,7 @@ static int tls_strp_copyin(read_descriptor_t *desc, struct sk_buff *in_skb,
 
 		/* We may have over-read, sz == 0 is guaranteed under-read */
 		if (sz > 0)
-			chunk =	min_t(size_t, chunk, sz - skb->len);
+			chunk =	min_t(size_t, chunk, (size_t)sz - skb->len);
 
 		skb->len += chunk;
 		skb->data_len += chunk;
-- 
2.35.3