From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752196AbcFEKV6 (ORCPT ); Sun, 5 Jun 2016 06:21:58 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:21752 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752128AbcFEKVv (ORCPT ); Sun, 5 Jun 2016 06:21:51 -0400 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Herbert Xu , Greg Kroah-Hartman , Willy Tarreau Subject: [PATCH 3.10 085/143] crypto: gcm - Fix rfc4543 decryption crash Date: Sun, 5 Jun 2016 12:19:48 +0200 Message-Id: <1465122046-9645-86-git-send-email-w@1wt.eu> X-Mailer: git-send-email 2.8.0.rc2.1.gbe9624a In-Reply-To: <1465122046-9645-1-git-send-email-w@1wt.eu> References: <1465122046-9645-1-git-send-email-w@1wt.eu> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Herbert Xu This bug has already bee fixed upstream since 4.2. However, it was fixed during the AEAD conversion so no fix was backported to the older kernels. When we do an RFC 4543 decryption, we will end up writing the ICV beyond the end of the dst buffer. This should lead to a crash but for some reason it was never noticed. This patch fixes it by only writing back the ICV for encryption. Fixes: d733ac90f9fe ("crypto: gcm - fix rfc4543 to handle async...") Reported-by: Patrick Meyer Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman Signed-off-by: Willy Tarreau --- crypto/gcm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crypto/gcm.c b/crypto/gcm.c index b4c2520..cd97cdd 100644 --- a/crypto/gcm.c +++ b/crypto/gcm.c @@ -1173,6 +1173,9 @@ static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req, aead_request_set_tfm(subreq, ctx->child); aead_request_set_callback(subreq, req->base.flags, crypto_rfc4543_done, req); + if (!enc) + aead_request_set_callback(subreq, req->base.flags, + req->base.complete, req->base.data); aead_request_set_crypt(subreq, cipher, cipher, enc ? 0 : authsize, iv); aead_request_set_assoc(subreq, assoc, assoclen); -- 2.8.0.rc2.1.gbe9624a