[Devel,RHEL7,COMMIT] ms/crypto: gcm - Fix rfc4543 decryption crash

Submitted by Konstantin Khorenko on Oct. 24, 2016, 12:34 p.m.

Details

Message ID 201610241234.u9OCY89O024667@finist_cl7.x64_64.work.ct
State New
Series "ms/crypto: gcm - Fix rfc4543 decryption crash"
Headers show

Commit Message

Konstantin Khorenko Oct. 24, 2016, 12:34 p.m.
The commit is pushed to "branch-rh7-3.10.0-327.36.1.vz7.19.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-327.36.1.vz7.19.3
------>
commit ac8ac641c0038eb46460ec71bb3c1db748bd1e2b
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Mon Oct 24 16:34:08 2016 +0400

    ms/crypto: gcm - Fix rfc4543 decryption crash
    
    This bug has already bee fixed upstream since 4.2.  However, it
    was fixed during the AEAD conversion so no fix was backported to
    the older kernels.
    
    When we do an RFC 4543 decryption, we will end up writing the
    ICV beyond the end of the dst buffer.  This should lead to a
    crash but for some reason it was never noticed.
    
    This patch fixes it by only writing back the ICV for encryption.
    
    Fixes: d733ac90f9fe ("crypto: gcm - fix rfc4543 to handle async...")
    Reported-by: Patrick Meyer <patrick.meyer@vasgard.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    
    Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
---
 crypto/gcm.c | 3 +++
 1 file changed, 3 insertions(+)

Patch hide | download patch | download mbox

diff --git a/crypto/gcm.c b/crypto/gcm.c
index 9cea4d0..f0bd00b 100644
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -1173,6 +1173,9 @@  static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req,
 	aead_request_set_tfm(subreq, ctx->child);
 	aead_request_set_callback(subreq, req->base.flags, crypto_rfc4543_done,
 				  req);
+	if (!enc)
+		aead_request_set_callback(subreq, req->base.flags,
+					  req->base.complete, req->base.data);
 	aead_request_set_crypt(subreq, cipher, cipher, enc ? 0 : authsize, iv);
 	aead_request_set_assoc(subreq, assoc, assoclen);