lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAGsJ_4yDS+RMGf1DbCTfDzRTt83t7nugwNGiNWNO8tsZ75Th5Q@mail.gmail.com> Date: Wed, 27 Dec 2023 19:05:57 +0800 From: Barry Song <21cnbao@...il.com> To: chengming.zhou@...ux.dev Cc: akpm@...ux-foundation.org, chrisl@...nel.org, davem@...emloft.net, herbert@...dor.apana.org.au, linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org, nphamcs@...il.com, syzkaller-bugs@...glegroups.com, yosryahmed@...gle.com, zhouchengming@...edance.com, syzbot+3eff5e51bf1db122a16e@...kaller.appspotmail.com Subject: Re: [PATCH v2] crypto: scompress - fix req->dst buffer overflow On Wed, Dec 27, 2023 at 5:35 PM <chengming.zhou@...ux.dev> wrote: > > From: Chengming Zhou <zhouchengming@...edance.com> > > The req->dst buffer size should be checked before copying from the > scomp_scratch->dst to avoid req->dst buffer overflow problem. > > Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") > Reported-by: syzbot+3eff5e51bf1db122a16e@...kaller.appspotmail.com > Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ > Signed-off-by: Chengming Zhou <zhouchengming@...edance.com> > --- > v2: > - change error code to ENOSPC. Reviewed-by: Barry Song <v-songbaohua@...o.com> > --- > crypto/scompress.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/crypto/scompress.c b/crypto/scompress.c > index 442a82c9de7d..b108a30a7600 100644 > --- a/crypto/scompress.c > +++ b/crypto/scompress.c > @@ -117,6 +117,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) > struct crypto_scomp *scomp = *tfm_ctx; > void **ctx = acomp_request_ctx(req); > struct scomp_scratch *scratch; > + unsigned int dlen; > int ret; > > if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) > @@ -128,6 +129,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) > if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) > req->dlen = SCOMP_SCRATCH_SIZE; > > + dlen = req->dlen; > + > scratch = raw_cpu_ptr(&scomp_scratch); > spin_lock(&scratch->lock); > > @@ -145,6 +148,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) > ret = -ENOMEM; > goto out; > } > + } else if (req->dlen > dlen) { > + ret = -ENOSPC; > + goto out; > } > scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen, > 1); > -- > 2.40.1 >
Powered by blists - more mailing lists