1
0
Fork 0
alistair23-linux/include
John Fastabend 7a3dd8c897 tls: async support causes out-of-bounds access in crypto APIs
When async support was added it needed to access the sk from the async
callback to report errors up the stack. The patch tried to use space
after the aead request struct by directly setting the reqsize field in
aead_request. This is an internal field that should not be used
outside the crypto APIs. It is used by the crypto code to define extra
space for private structures used in the crypto context. Users of the
API then use crypto_aead_reqsize() and add the returned amount of
bytes to the end of the request memory allocation before posting the
request to encrypt/decrypt APIs.

So this breaks (with general protection fault and KASAN error, if
enabled) because the request sent to decrypt is shorter than required
causing the crypto API out-of-bounds errors. Also it seems unlikely the
sk is even valid by the time it gets to the callback because of memset
in crypto layer.

Anyways, fix this by holding the sk in the skb->sk field when the
callback is set up and because the skb is already passed through to
the callback handler via void* we can access it in the handler. Then
in the handler we need to be careful to NULL the pointer again before
kfree_skb. I added comments on both the setup (in tls_do_decryption)
and when we clear it from the crypto callback handler
tls_decrypt_done(). After this selftests pass again and fixes KASAN
errors/warnings.

Fixes: 94524d8fc9 ("net/tls: Add support for async decryption of tls records")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Reviewed-by: Vakul Garg <Vakul.garg@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-09-17 08:01:36 -07:00
..
acpi ACPICA: Update version to 20180810 2018-08-14 23:49:13 +02:00
asm-generic Kbuild updates for v4.19 (2nd) 2018-08-25 13:40:38 -07:00
clocksource
crypto crypto: scatterwalk - remove scatterwalk_samebuf() 2018-08-03 18:06:04 +08:00
drm drm pull for 4.19-rc1 2018-08-15 17:39:07 -07:00
dt-bindings ARM: SoC: late updates 2018-08-25 14:12:36 -07:00
keys
kvm KVM: arm/arm64: vgic-v3: Add core support for Group0 SGIs 2018-08-12 12:06:34 +01:00
linux net: move definition of pcpu_lstats to header file 2018-09-14 08:32:23 -07:00
math-emu
media - New Drivers 2018-08-20 15:38:44 -07:00
memory
misc
net tls: async support causes out-of-bounds access in crypto APIs 2018-09-17 08:01:36 -07:00
pcmcia pcmcia: remove long deprecated pcmcia_request_exclusive_irq() function 2018-08-18 12:30:42 -07:00
ras
rdma Second merge window update 2018-08-23 15:34:48 -07:00
scsi SCSI misc on 20180815 2018-08-15 22:06:26 -07:00
soc Various updates to soc/fsl for 4.19 2018-07-26 00:12:56 -07:00
sound ASoC: Updates for v4.19 2018-08-13 12:12:31 +02:00
target scsi: target: add session removal function 2018-08-02 15:29:31 -04:00
trace Merge branch 'for-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup 2018-08-24 13:19:27 -07:00
uapi ipv6: Add sockopt IPV6_MULTICAST_ALL analogue to IP_MULTICAST_ALL 2018-09-13 08:17:27 -07:00
video fbdev changes for v4.19: 2018-08-23 15:44:58 -07:00
xen Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2018-08-18 16:48:07 -07:00