Re: [PATCH v2 2/3] crypto: marvell: fix stack smashing in marvell/hash.c

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, 09 Oct 2015 11:48:49 +0100
Russell King <rmk+kernel@xxxxxxxxxxxxxxxx> (by way of Thomas Petazzoni
<thomas.petazzoni@xxxxxxxxxxxxxxxxxx>) wrote:

> Several of the algorithms in marvell/hash.c have a statesize of zero.
> When an AF_ALG accept() on an already-accepted file descriptor to
> calls into hash_accept(), this causes:
> 
> 	char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req))];
> 
> to be zero-sized, but we still pass this to:
> 
> 	err = crypto_ahash_export(req, state);
> 
> which proceeds to write to 'state' as if it was a "struct md5_state",
> "struct sha1_state" etc.  Add the necessary initialisers for the
> .statesize member.
> 
> Signed-off-by: Russell King <rmk+kernel@xxxxxxxxxxxxxxxx>

Acked-by: Boris Brezillon <boris.brezillon@xxxxxxxxxxxxxxxxxx>

> ---
>  drivers/crypto/marvell/hash.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
> index e8d0d7128137..a259aced3b42 100644
> --- a/drivers/crypto/marvell/hash.c
> +++ b/drivers/crypto/marvell/hash.c
> @@ -870,6 +870,7 @@ struct ahash_alg mv_md5_alg = {
>  	.import = mv_cesa_md5_import,
>  	.halg = {
>  		.digestsize = MD5_DIGEST_SIZE,
> +		.statesize = sizeof(struct md5_state),
>  		.base = {
>  			.cra_name = "md5",
>  			.cra_driver_name = "mv-md5",
> @@ -959,6 +960,7 @@ struct ahash_alg mv_sha1_alg = {
>  	.import = mv_cesa_sha1_import,
>  	.halg = {
>  		.digestsize = SHA1_DIGEST_SIZE,
> +		.statesize = sizeof(struct sha1_state),
>  		.base = {
>  			.cra_name = "sha1",
>  			.cra_driver_name = "mv-sha1",
> @@ -1048,6 +1050,7 @@ struct ahash_alg mv_sha256_alg = {
>  	.import = mv_cesa_sha256_import,
>  	.halg = {
>  		.digestsize = SHA256_DIGEST_SIZE,
> +		.statesize = sizeof(struct sha256_state),
>  		.base = {
>  			.cra_name = "sha256",
>  			.cra_driver_name = "mv-sha256",



-- 
Boris Brezillon, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com
--
To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Kernel]     [Gnu Classpath]     [Gnu Crypto]     [DM Crypt]     [Netfilter]     [Bugtraq]

  Powered by Linux