Eric Biggers 3619dec510 dh key: fix rounding up KDF output length ... Commit 383203eff7 ("dh key: get rid of stack allocated array") changed kdf_ctr() to assume that the length of key material to derive is a multiple of the digest size. The length was supposed to be rounded up accordingly. However, the round_up() macro was used which only gives the correct result on power-of-2 arguments, whereas not all hash algorithms have power-of-2 digest sizes. In some cases this resulted in a write past the end of the 'outbuf' buffer. Fix it by switching to roundup(), which works for non-power-of-2 inputs. Reported-by: syzbot+486f97f892efeb2075a3@syzkaller.appspotmail.com Reported-by: syzbot+29d17b7898b41ee120a5@syzkaller.appspotmail.com Reported-by: syzbot+8a608baf8751184ec727@syzkaller.appspotmail.com Reported-by: syzbot+d04e58bd384f1fe0b112@syzkaller.appspotmail.com Fixes: 383203eff7 ("dh key: get rid of stack allocated array") Signed-off-by: Eric Biggers <ebiggers@google.com> Acked-by: Kees Cook <keescook@chromium.org> Acked-by: Tycho Andersen <tycho@tycho.ws> Signed-off-by: James Morris <james.morris@microsoft.com>		2018-06-26 09:43:05 -07:00
..
apparmor	+ Features	2018-06-14 16:11:28 +09:00
integrity	Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2018-06-07 15:40:37 -07:00
keys	dh key: fix rounding up KDF output length	2018-06-26 09:43:05 -07:00
loadpin	get rid of pointless includes of fs_struct.h	2018-02-22 14:28:50 -05:00
selinux	docs: Fix some broken references	2018-06-15 18:10:01 -03:00
smack	Smack: Mark inode instant in smack_task_to_inode	2018-06-23 10:45:56 +09:00
tomoyo	net: make getname() functions return length rather than use int* parameter	2018-02-12 14:15:04 -05:00
yama	pids: introduce find_get_task_by_vpid() helper	2018-02-06 18:32:46 -08:00
commoncap.c	capabilities: Allow privileged user in s_user_ns to set security.* xattrs	2018-05-24 12:03:31 -05:00
device_cgroup.c	docs: fix broken references with multiple hints	2018-06-15 18:10:01 -03:00
inode.c	securityfs: add the ability to support symlinks	2017-06-08 12:51:43 -07:00
Kconfig	Currently, hardened usercopy performs dynamic bounds checking on slab	2018-02-03 16:25:42 -08:00
lsm_audit.c	audit: use inline function to get audit context	2018-05-14 17:24:18 -04:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
min_addr.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
security.c	security: add hook for socketpair()	2018-05-04 12:48:54 -07:00