Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3463e51d authored by Kees Cook's avatar Kees Cook Committed by David S. Miller
Browse files

net/tls: Remove VLA usage on nonce 



It looks like the prior VLA removal, commit b16520f7 ("net/tls: Remove
VLA usage"), and a new VLA addition, commit c46234eb ("tls: RX path
for ktls"), passed in the night. This removes the newly added VLA, which
happens to have its bounds based on the same max value.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 27a2628b

net/tls/tls_sw.c

+8 −2
Original line number Diff line number Diff line
@@ -941,7 +941,7 @@ static int tls_read_size(struct strparser *strp, struct sk_buff *skb) 
{

	struct tls_context *tls_ctx = tls_get_ctx(strp->sk);

	struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);

	char header[tls_ctx->rx.prepend_size];

	char header[TLS_HEADER_SIZE + MAX_IV_SIZE];

	struct strp_msg *rxm = strp_msg(skb);

	size_t cipher_overhead;

	size_t data_len = 0;
@@ -951,6 +951,12 @@ static int tls_read_size(struct strparser *strp, struct sk_buff *skb) 
	if (rxm->offset + tls_ctx->rx.prepend_size > skb->len)

		return 0;



	/* Sanity-check size of on-stack buffer. */

	if (WARN_ON(tls_ctx->rx.prepend_size > sizeof(header))) {

		ret = -EINVAL;

		goto read_failure;

	}



	/* Linearize header to local buffer */

	ret = skb_copy_bits(skb, rxm->offset, header, tls_ctx->rx.prepend_size);
@@ -1108,7 +1114,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx) 
	}



	/* Sanity-check the IV size for stack allocations. */

	if (iv_size > MAX_IV_SIZE) {

	if (iv_size > MAX_IV_SIZE || nonce_size > MAX_IV_SIZE) {

		rc = -EINVAL;

		goto free_priv;

	}