All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Cong Wang <cong.wang@bytedance.com>,
	syzbot+b2bf2652983d23734c5c@syzkaller.appspotmail.com,
	Steffen Klassert <steffen.klassert@secunet.com>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	Sasha Levin <sashal@kernel.org>,
	netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 01/25] af_key: relax availability checks for skb size calculation
Date: Tue,  2 Feb 2021 10:05:51 -0500	[thread overview]
Message-ID: <20210202150615.1864175-1-sashal@kernel.org> (raw)

From: Cong Wang <cong.wang@bytedance.com>

[ Upstream commit afbc293add6466f8f3f0c3d944d85f53709c170f ]

xfrm_probe_algs() probes kernel crypto modules and changes the
availability of struct xfrm_algo_desc. But there is a small window
where ealg->available and aalg->available get changed between
count_ah_combs()/count_esp_combs() and dump_ah_combs()/dump_esp_combs(),
in this case we may allocate a smaller skb but later put a larger
amount of data and trigger the panic in skb_put().

Fix this by relaxing the checks when counting the size, that is,
skipping the test of ->available. We may waste some memory for a few
of sizeof(struct sadb_comb), but it is still much better than a panic.

Reported-by: syzbot+b2bf2652983d23734c5c@syzkaller.appspotmail.com
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/key/af_key.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/key/af_key.c b/net/key/af_key.c
index c12dbc51ef5fe..ef9b4ac03e7b7 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2902,7 +2902,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t)
 			break;
 		if (!aalg->pfkey_supported)
 			continue;
-		if (aalg_tmpl_set(t, aalg) && aalg->available)
+		if (aalg_tmpl_set(t, aalg))
 			sz += sizeof(struct sadb_comb);
 	}
 	return sz + sizeof(struct sadb_prop);
@@ -2920,7 +2920,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
 		if (!ealg->pfkey_supported)
 			continue;
 
-		if (!(ealg_tmpl_set(t, ealg) && ealg->available))
+		if (!(ealg_tmpl_set(t, ealg)))
 			continue;
 
 		for (k = 1; ; k++) {
@@ -2931,7 +2931,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
 			if (!aalg->pfkey_supported)
 				continue;
 
-			if (aalg_tmpl_set(t, aalg) && aalg->available)
+			if (aalg_tmpl_set(t, aalg))
 				sz += sizeof(struct sadb_comb);
 		}
 	}
-- 
2.27.0


             reply	other threads:[~2021-02-02 15:10 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-02 15:05 Sasha Levin [this message]
2021-02-02 15:05 ` [PATCH AUTOSEL 5.10 02/25] regulator: core: avoid regulator_resolve_supply() race condition Sasha Levin
2021-02-02 16:12   ` Mark Brown
2021-02-03  1:04     ` Sasha Levin
2021-02-03 12:12       ` Mark Brown
2021-02-02 15:05 ` [PATCH AUTOSEL 5.10 03/25] ASoC: wm_adsp: Fix control name parsing for multi-fw Sasha Levin
2021-02-02 15:05   ` Sasha Levin
2021-02-02 15:05 ` [PATCH AUTOSEL 5.10 04/25] drm/nouveau/nvif: fix method count when pushing an array Sasha Levin
2021-02-02 15:05   ` Sasha Levin
2021-02-02 15:05   ` [Nouveau] " Sasha Levin
2021-02-02 15:05 ` [PATCH AUTOSEL 5.10 05/25] mac80211: 160MHz with extended NSS BW in CSA Sasha Levin
2021-02-02 15:05 ` [PATCH AUTOSEL 5.10 06/25] ASoC: Intel: Skylake: Zero snd_ctl_elem_value Sasha Levin
2021-02-02 15:05   ` Sasha Levin
2021-02-02 15:05 ` [PATCH AUTOSEL 5.10 07/25] chtls: Fix potential resource leak Sasha Levin
2021-02-02 15:05 ` [PATCH AUTOSEL 5.10 08/25] pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process() Sasha Levin
2021-02-02 15:05 ` [PATCH AUTOSEL 5.10 09/25] pNFS/NFSv4: Improve rejection of out-of-order layouts Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 10/25] ALSA: hda: intel-dsp-config: add PCI id for TGL-H Sasha Levin
2021-02-02 15:06   ` Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 11/25] ASoC: ak4458: correct reset polarity Sasha Levin
2021-02-02 15:06   ` Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 12/25] ASoC: Intel: sof_sdw: set proper flags for Dell TGL-H SKU 0A5E Sasha Levin
2021-02-02 15:06   ` Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 13/25] iwlwifi: mvm: skip power command when unbinding vif during CSA Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 14/25] iwlwifi: mvm: take mutex for calling iwl_mvm_get_sync_time() Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 15/25] iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 16/25] iwlwifi: pcie: fix context info memory leak Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 17/25] iwlwifi: mvm: invalidate IDs of internal stations at mvm start Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 18/25] iwlwifi: pcie: add rules to match Qu with Hr2 Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 19/25] iwlwifi: mvm: guard against device removal in reprobe Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 20/25] iwlwifi: queue: bail out on invalid freeing Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 21/25] SUNRPC: Move simple_get_bytes and simple_get_netobj into private header Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 22/25] SUNRPC: Handle 0 length opaque XDR object data properly Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 23/25] i2c: mediatek: Move suspend and resume handling to NOIRQ phase Sasha Levin
2021-02-02 15:06   ` Sasha Levin
2021-02-02 15:06   ` Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 24/25] blk-cgroup: Use cond_resched() when destroy blkgs Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.10 25/25] nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a SPCC device Sasha Levin
2021-02-02 15:06   ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210202150615.1864175-1-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=cong.wang@bytedance.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=steffen.klassert@secunet.com \
    --cc=syzbot+b2bf2652983d23734c5c@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.