Commit 97e1caa5 authored Apr 25, 2019 by Jakub Kicinski Committed by David S. Miller Apr 27, 2019

net/tls: don't copy negative amounts of data in reencrypt



There is no guarantee the record starts before the skb frags.
If we don't check for this condition copy amount will get
negative, leading to reads and writes to random memory locations.
Familiar hilarity ensues.

Fixes: 4799ac81 ("tls: Add rx inline crypto offload")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: John Hurley <john.hurley@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent b2a20fd0

net/tls/tls_device.c

+8 −6

Original line number	Diff line number	Diff line
		@@ -628,6 +628,7 @@ static int tls_device_reencrypt(struct sock sk, struct sk_buff skb)
		else
		err = 0;

		if (skb_pagelen(skb) > offset) {
		copy = min_t(int, skb_pagelen(skb) - offset,
		rxm->full_len - TLS_CIPHER_AES_GCM_128_TAG_SIZE);

		@@ -636,6 +637,7 @@ static int tls_device_reencrypt(struct sock sk, struct sk_buff skb)

		offset += copy;
		buf += copy;
		}

		skb_walk_frags(skb, skb_iter) {
		copy = min_t(int, skb_iter->len,