Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e0e3f4a1 authored by Chengming Zhou's avatar Chengming Zhou Committed by Greg Kroah-Hartman
Browse files

crypto: scomp - fix req->dst buffer overflow 



[ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ]

The req->dst buffer size should be checked before copying from the
scomp_scratch->dst to avoid req->dst buffer overflow problem.

Fixes: 1ab53a77 ("crypto: acomp - add driver-side scomp interface")
Reported-by: default avatar <syzbot+3eff5e51bf1db122a16e@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/


Signed-off-by: default avatarChengming Zhou <zhouchengming@bytedance.com>
Reviewed-by: default avatarBarry Song <v-songbaohua@oppo.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 77d2b183

crypto/scompress.c

+6 −0
Original line number Diff line number Diff line
@@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) 
	struct crypto_scomp *scomp = *tfm_ctx;

	void **ctx = acomp_request_ctx(req);

	struct scomp_scratch *scratch;

	unsigned int dlen;

	int ret;



	if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE)
@@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) 
	if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE)

		req->dlen = SCOMP_SCRATCH_SIZE;



	dlen = req->dlen;



	scratch = raw_cpu_ptr(&scomp_scratch);

	spin_lock(&scratch->lock);
@@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) 
				ret = -ENOMEM;

				goto out;

			}

		} else if (req->dlen > dlen) {

			ret = -ENOSPC;

			goto out;

		}

		scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen,

					 1);