All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 5.4 01/17] af_key: relax availability checks for skb size calculation
@ 2021-02-02 15:06 Sasha Levin
  2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 02/17] regulator: core: avoid regulator_resolve_supply() race condition Sasha Levin
                   ` (15 more replies)
  0 siblings, 16 replies; 21+ messages in thread
From: Sasha Levin @ 2021-02-02 15:06 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Cong Wang, syzbot+b2bf2652983d23734c5c, Steffen Klassert,
	Herbert Xu, Sasha Levin, netdev

From: Cong Wang <cong.wang@bytedance.com>

[ Upstream commit afbc293add6466f8f3f0c3d944d85f53709c170f ]

xfrm_probe_algs() probes kernel crypto modules and changes the
availability of struct xfrm_algo_desc. But there is a small window
where ealg->available and aalg->available get changed between
count_ah_combs()/count_esp_combs() and dump_ah_combs()/dump_esp_combs(),
in this case we may allocate a smaller skb but later put a larger
amount of data and trigger the panic in skb_put().

Fix this by relaxing the checks when counting the size, that is,
skipping the test of ->available. We may waste some memory for a few
of sizeof(struct sadb_comb), but it is still much better than a panic.

Reported-by: syzbot+b2bf2652983d23734c5c@syzkaller.appspotmail.com
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/key/af_key.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/key/af_key.c b/net/key/af_key.c
index a915bc86620af..907d04a474597 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2902,7 +2902,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t)
 			break;
 		if (!aalg->pfkey_supported)
 			continue;
-		if (aalg_tmpl_set(t, aalg) && aalg->available)
+		if (aalg_tmpl_set(t, aalg))
 			sz += sizeof(struct sadb_comb);
 	}
 	return sz + sizeof(struct sadb_prop);
@@ -2920,7 +2920,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
 		if (!ealg->pfkey_supported)
 			continue;
 
-		if (!(ealg_tmpl_set(t, ealg) && ealg->available))
+		if (!(ealg_tmpl_set(t, ealg)))
 			continue;
 
 		for (k = 1; ; k++) {
@@ -2931,7 +2931,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
 			if (!aalg->pfkey_supported)
 				continue;
 
-			if (aalg_tmpl_set(t, aalg) && aalg->available)
+			if (aalg_tmpl_set(t, aalg))
 				sz += sizeof(struct sadb_comb);
 		}
 	}
-- 
2.27.0


^ permalink raw reply related	[flat|nested] 21+ messages in thread

end of thread, other threads:[~2021-02-02 16:02 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-02 15:06 [PATCH AUTOSEL 5.4 01/17] af_key: relax availability checks for skb size calculation Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 02/17] regulator: core: avoid regulator_resolve_supply() race condition Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 03/17] mac80211: 160MHz with extended NSS BW in CSA Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 04/17] ASoC: Intel: Skylake: Zero snd_ctl_elem_value Sasha Levin
2021-02-02 15:06   ` Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 05/17] chtls: Fix potential resource leak Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 06/17] pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process() Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 07/17] ASoC: ak4458: correct reset polarity Sasha Levin
2021-02-02 15:06   ` Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 08/17] iwlwifi: mvm: skip power command when unbinding vif during CSA Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 09/17] iwlwifi: mvm: take mutex for calling iwl_mvm_get_sync_time() Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 10/17] iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 11/17] iwlwifi: pcie: fix context info memory leak Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 12/17] iwlwifi: mvm: invalidate IDs of internal stations at mvm start Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 13/17] iwlwifi: mvm: guard against device removal in reprobe Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 14/17] SUNRPC: Move simple_get_bytes and simple_get_netobj into private header Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 15/17] SUNRPC: Handle 0 length opaque XDR object data properly Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 16/17] i2c: mediatek: Move suspend and resume handling to NOIRQ phase Sasha Levin
2021-02-02 15:06   ` Sasha Levin
2021-02-02 15:06   ` Sasha Levin
2021-02-02 15:06 ` [PATCH AUTOSEL 5.4 17/17] blk-cgroup: Use cond_resched() when destroy blkgs Sasha Levin

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.