leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tls: fix skb_to_sgvec returning unhandled error.

Browse Source 
The current code does not inspect the return value of skb_to_sgvec. This
can cause a nullptr kernel panic when the malformed sgvec is passed into
the crypto request.

Checking the return value of skb_to_sgvec and skipping decryption if it
is negative fixes this problem.

Fixes: c46234ebb4 ("tls: RX path for ktls")
Acked-by: Dave Watson <davejwatson@fb.com>
Signed-off-by: Doron Roberts-Kedes <doronrk@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Doron Roberts-Kedes
2018-07-02 10:25:05 -07:00
committed by David S. Miller
parent c643ecf354
commit 52ee6ef36e
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
net/tls/tls_sw.c
View File

@@ -701,6 +701,10 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
nsg = skb_to_sgvec(skb, &sgin[1], nsg = skb_to_sgvec(skb, &sgin[1],
rxm->offset + tls_ctx->rx.prepend_size, rxm->offset + tls_ctx->rx.prepend_size,
rxm->full_len - tls_ctx->rx.prepend_size); rxm->full_len - tls_ctx->rx.prepend_size);
if (nsg < 0) {
ret = nsg;
goto out;
}
tls_make_aad(ctx->rx_aad_ciphertext, tls_make_aad(ctx->rx_aad_ciphertext,
rxm->full_len - tls_ctx->rx.overhead_size, rxm->full_len - tls_ctx->rx.overhead_size,
@@ -712,6 +716,7 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
rxm->full_len - tls_ctx->rx.overhead_size, rxm->full_len - tls_ctx->rx.overhead_size,
skb, sk->sk_allocation); skb, sk->sk_allocation);
out:
if (sgin != &sgin_arr[0]) if (sgin != &sgin_arr[0])
kfree(sgin); kfree(sgin);