Commit 9c674e1e authored Jan 18, 2018 by Stephan Mueller Committed by Herbert Xu Jan 26, 2018

crypto: aesni - handle zero length dst buffer



GCM can be invoked with a zero destination buffer. This is possible if
the AAD and the ciphertext have zero lengths and only the tag exists in
the source buffer (i.e. a source buffer cannot be zero). In this case,
the GCM cipher only performs the authentication and no decryption
operation.

When the destination buffer has zero length, it is possible that no page
is mapped to the SG pointing to the destination. In this case,
sg_page(req->dst) is an invalid access. Therefore, page accesses should
only be allowed if the req->dst->length is non-zero which is the
indicator that a page must exist.

This fixes a crash that can be triggered by user space via AF_ALG.

CC: <stable@vger.kernel.org>
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

parent 980b4c95

arch/x86/crypto/aesni-intel_glue.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -824,7 +824,7 @@ static int gcmaes_decrypt(struct aead_request *req, unsigned int assoclen,
		if (sg_is_last(req->src) &&
		(!PageHighMem(sg_page(req->src)) \|\|
		req->src->offset + req->src->length <= PAGE_SIZE) &&
		sg_is_last(req->dst) &&
		sg_is_last(req->dst) && req->dst->length &&
		(!PageHighMem(sg_page(req->dst)) \|\|
		req->dst->offset + req->dst->length <= PAGE_SIZE)) {
		one_entry_in_sg = 1;