netdev - Re: [net v2] net/tls: fix corrupted data in recvmsg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 16 Nov 2020 17:12:54 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Vadim Fedorenko <vfedorenko@...ek.ru>
Cc:     Boris Pismenny <borisp@...dia.com>,
        Aviad Yehezkel <aviadye@...dia.com>, netdev@...r.kernel.org
Subject: Re: [net v2] net/tls: fix corrupted data in recvmsg

On Tue, 17 Nov 2020 00:59:54 +0000 Vadim Fedorenko wrote:
> >>> Sorry I wasn't clear enough, should this be:
> >>>
> >>> 	if (ctx->control != control)
> >>>
> >>> ? Otherwise if we get a control record first and then data record
> >>> the code will collapse them, which isn't correct, right?
> >>>     
> >>>>    				goto recv_end;
> >>>>    		} else {
> >>>>    			break;  
> >> I think you mean when ctx->control is control record and control is
> >> data record.  
> > Yup.
> >  
> >> In this case control message will be decrypted without
> >> zero copy and will be stored in skb for the next recvmsg, but will
> >> not be returned together with data message.  
> > Could you point me to a line which breaks the loop in that case?
> >  
> Sure!
> 
> 		if (!control)
> 			control = tlm->control;
> 		else if (control != tlm->control)
> 			goto recv_end;
> 
> 
> In that case control != tlm->control
> Variable control is set only once and never changes again.

You're right! Applied, thanks!