* [PATCH net-next] net/tls: Remove VLA usage on nonce
@ 2018-06-25 23:55 Kees Cook
2018-06-27 1:40 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Kees Cook @ 2018-06-25 23:55 UTC (permalink / raw)
To: Dave Watson
Cc: Boris Pismenny, Aviad Yehezkel, David S. Miller, netdev, linux-kernel
It looks like the prior VLA removal, commit b16520f7493d ("net/tls: Remove
VLA usage"), and a new VLA addition, commit c46234ebb4d1e ("tls: RX path
for ktls"), passed in the night. This removes the newly added VLA, which
happens to have its bounds based on the same max value.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
net/tls/tls_sw.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index f127fac88acf..3e0b64549552 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -941,7 +941,7 @@ static int tls_read_size(struct strparser *strp, struct sk_buff *skb)
{
struct tls_context *tls_ctx = tls_get_ctx(strp->sk);
struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
- char header[tls_ctx->rx.prepend_size];
+ char header[TLS_HEADER_SIZE + MAX_IV_SIZE];
struct strp_msg *rxm = strp_msg(skb);
size_t cipher_overhead;
size_t data_len = 0;
@@ -951,6 +951,12 @@ static int tls_read_size(struct strparser *strp, struct sk_buff *skb)
if (rxm->offset + tls_ctx->rx.prepend_size > skb->len)
return 0;
+ /* Sanity-check size of on-stack buffer. */
+ if (WARN_ON(tls_ctx->rx.prepend_size > sizeof(header))) {
+ ret = -EINVAL;
+ goto read_failure;
+ }
+
/* Linearize header to local buffer */
ret = skb_copy_bits(skb, rxm->offset, header, tls_ctx->rx.prepend_size);
@@ -1111,7 +1117,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
}
/* Sanity-check the IV size for stack allocations. */
- if (iv_size > MAX_IV_SIZE) {
+ if (iv_size > MAX_IV_SIZE || nonce_size > MAX_IV_SIZE) {
rc = -EINVAL;
goto free_priv;
}
--
2.17.1
--
Kees Cook
Pixel Security
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-next] net/tls: Remove VLA usage on nonce
2018-06-25 23:55 [PATCH net-next] net/tls: Remove VLA usage on nonce Kees Cook
@ 2018-06-27 1:40 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2018-06-27 1:40 UTC (permalink / raw)
To: keescook; +Cc: davejwatson, borisp, aviadye, netdev, linux-kernel
From: Kees Cook <keescook@chromium.org>
Date: Mon, 25 Jun 2018 16:55:05 -0700
> It looks like the prior VLA removal, commit b16520f7493d ("net/tls: Remove
> VLA usage"), and a new VLA addition, commit c46234ebb4d1e ("tls: RX path
> for ktls"), passed in the night. This removes the newly added VLA, which
> happens to have its bounds based on the same max value.
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
Applied, thanks Kees.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-06-27 1:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-06-25 23:55 [PATCH net-next] net/tls: Remove VLA usage on nonce Kees Cook
2018-06-27 1:40 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.