Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fac13c1d authored by Cong Wang's avatar Cong Wang Committed by Greg Kroah-Hartman
Browse files

af_key: relax availability checks for skb size calculation 



[ Upstream commit afbc293add6466f8f3f0c3d944d85f53709c170f ]

xfrm_probe_algs() probes kernel crypto modules and changes the
availability of struct xfrm_algo_desc. But there is a small window
where ealg->available and aalg->available get changed between
count_ah_combs()/count_esp_combs() and dump_ah_combs()/dump_esp_combs(),
in this case we may allocate a smaller skb but later put a larger
amount of data and trigger the panic in skb_put().

Fix this by relaxing the checks when counting the size, that is,
skipping the test of ->available. We may waste some memory for a few
of sizeof(struct sadb_comb), but it is still much better than a panic.

Reported-by: default avatar <syzbot+b2bf2652983d23734c5c@syzkaller.appspotmail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarCong Wang <cong.wang@bytedance.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 4f123852

net/key/af_key.c

+3 −3
Original line number Diff line number Diff line
@@ -2908,7 +2908,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t) 
			break;

		if (!aalg->pfkey_supported)

			continue;

		if (aalg_tmpl_set(t, aalg) && aalg->available)

		if (aalg_tmpl_set(t, aalg))

			sz += sizeof(struct sadb_comb);

	}

	return sz + sizeof(struct sadb_prop);
@@ -2926,7 +2926,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t) 
		if (!ealg->pfkey_supported)

			continue;



		if (!(ealg_tmpl_set(t, ealg) && ealg->available))

		if (!(ealg_tmpl_set(t, ealg)))

			continue;



		for (k = 1; ; k++) {
@@ -2937,7 +2937,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t) 
			if (!aalg->pfkey_supported)

				continue;



			if (aalg_tmpl_set(t, aalg) && aalg->available)

			if (aalg_tmpl_set(t, aalg))

				sz += sizeof(struct sadb_comb);

		}

	}