netdev - Re: [PATCH net-next v2 06/13] rxrpc: rxgk: Provide infrastructure and key derivation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2099212.1744268049@warthog.procyon.org.uk>
Date: Thu, 10 Apr 2025 07:54:09 +0100
From: David Howells <dhowells@...hat.com>
To: Jakub Kicinski <kuba@...nel.org>
Cc: dhowells@...hat.com, netdev@...r.kernel.org,
    Marc Dionne <marc.dionne@...istor.com>,
    "David S.
 Miller" <davem@...emloft.net>,
    Eric Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>,
    Simon Horman <horms@...nel.org>,
    Christian Brauner <brauner@...nel.org>,
    Chuck Lever <chuck.lever@...cle.com>, linux-afs@...ts.infradead.org,
    linux-kernel@...r.kernel.org,
    Herbert Xu <herbert@...dor.apana.org.au>,
    linux-crypto@...r.kernel.org
Subject: Re: [PATCH net-next v2 06/13] rxrpc: rxgk: Provide infrastructure and key derivation

Jakub Kicinski <kuba@...nel.org> wrote:

> On Mon,  7 Apr 2025 17:11:19 +0100 David Howells wrote:
> > +	aead = crypto_krb5_prepare_encryption(krb5, &TK, RXGK_CLIENT_ENC_RESPONSE, gfp);
> > +	if (IS_ERR(aead))
> > +		goto aead_error;
> > +	gk->resp_enc = aead;
> > +
> > +	if (crypto_aead_blocksize(gk->resp_enc) != krb5->block_len ||
> > +	    crypto_aead_authsize(gk->resp_enc) != krb5->cksum_len) {
> > +		pr_notice("algo inconsistent with krb5 table %u!=%u or %u!=%u\n",
> > +			  crypto_aead_blocksize(gk->resp_enc), krb5->block_len,
> > +			  crypto_aead_authsize(gk->resp_enc), krb5->cksum_len);
> > +		return -EINVAL;
> 
> kfree_sensitive(buffer); missing?

Good catch, thanks.  That path should never trigger, but it should really do
"ret = -EINVAL; goto out;".

Do you want me to respin the patches or follow up with a fix patch?

David