[PATCH] xfrm: reject sub-32-bit or unaligned alg_trunc_len in attach_auth_trunc()

[Hui Peng <benquike@gmail.com>]

In attach_auth_trunc(), userspace supplies `ualg->alg_trunc_len` (in
bits) via XFRMA_ALG_AUTH_TRUNC, and attach_auth_trunc() only checks that
`ualg->alg_trunc_len <= algo->uinfo.auth.icv_fullbits`.

However, ESP and AH convert `alg_trunc_len` to bytes via `esp_authsize =
ALIGN(x->aalg->alg_trunc_len, 8) >> 3` or `ah_authsize =
x->aalg->alg_trunc_len >> 3`, and pass `authsize` to
`crypto_aead_setauthsize()` or `ah_init_state()`. If `alg_trunc_len` is
not a multiple of 8 bits (or is between 1 and 31 bits), integer division
by 8 truncates the requested bit length (for example, `alg_trunc_len ==
7` yields a 0-byte ICV in AH, or `alg_trunc_len` not divisible by 8
mismatches the ICV byte length between AH and ESP).

Reject `alg_trunc_len` values that are not a multiple of 8 bits
(`ualg->alg_trunc_len & 7`) or non-zero values smaller than 32 bits
(`ualg->alg_trunc_len > 0 && ualg->alg_trunc_len < 32`) with `-EINVAL`.

Fixes: 4447bb33f094 ("xfrm: Store aalg in xfrm_state with a user specified truncation length")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 net/xfrm/xfrm_user.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index a2587c7e796b..d56a0095113b 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -698,7 +698,9 @@ static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props,
 		NL_SET_ERR_MSG(extack, "Requested AUTH_TRUNC algorithm not found");
 		return -ENOSYS;
 	}
-	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits) {
+	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits ||
+	    (ualg->alg_trunc_len & 7) ||
+	    (ualg->alg_trunc_len > 0 && ualg->alg_trunc_len < 32)) {
 		NL_SET_ERR_MSG(extack, "Invalid length requested for truncated ICV");
 		return -EINVAL;
 	}
-- 
2.55.0.1082.g2b9226bbc0-goog