From: Dan Carpenter <dan.carpenter@oracle.com>
To: kbuild@01.org, Wenwen Wang <wang6495@umn.edu>
Cc: kbuild-all@01.org, Wenwen Wang <wang6495@umn.edu>,
Kangjie Lu <kjlu@umn.edu>, Harsh Jain <harsh@chelsio.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
Atul Gupta <atul.gupta@chelsio.com>,
Michael Werner <werner@chelsio.com>,
Casey Leedom <leedom@chelsio.com>,
"open list:CXGB4 CRYPTO DRIVER (chcr)"
<linux-crypto@vger.kernel.org>,
open list <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] crypto: chtls - fix a missing-check bug
Date: Mon, 7 May 2018 13:39:54 +0300 [thread overview]
Message-ID: <20180507103954.d3gfgyjnce2ctp4p@mwanda> (raw)
In-Reply-To: <1525546431-12535-1-git-send-email-wang6495@umn.edu>
Hi Wenwen,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on cryptodev/master]
[also build test WARNING on v4.17-rc3 next-20180504]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/Wenwen-Wang/crypto-chtls-fix-a-missing-check-bug/20180506-091039
base: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
:::::: branch date: 26 hours ago
:::::: commit date: 26 hours ago
New smatch warnings:
drivers/crypto/chelsio/chtls/chtls_main.c:496 do_chtls_setsockopt() warn: potential pointer math issue ('crypto_info' is a 32 bit pointer)
Old smatch warnings:
drivers/crypto/chelsio/chtls/chtls_main.c:253 chtls_uld_add() error: buffer overflow 'cdev->rspq_skb_cache' 32 <= 32
drivers/crypto/chelsio/chtls/chtls_main.c:350 chtls_recv_packet() error: double free of 'skb'
drivers/crypto/chelsio/chtls/chtls_main.c:390 chtls_recv_rsp() error: double free of 'skb'
drivers/crypto/chelsio/chtls/chtls_main.c:408 chtls_recv() error: double free of 'skb'
# https://github.com/0day-ci/linux/commit/183b5e3e71c75e3149dac2698883f0bd63a89c75
git remote add linux-review https://github.com/0day-ci/linux
git remote update linux-review
git checkout 183b5e3e71c75e3149dac2698883f0bd63a89c75
vim +496 drivers/crypto/chelsio/chtls/chtls_main.c
a0894394 Atul Gupta 2018-03-31 461
a0894394 Atul Gupta 2018-03-31 462 static int do_chtls_setsockopt(struct sock *sk, int optname,
a0894394 Atul Gupta 2018-03-31 463 char __user *optval, unsigned int optlen)
a0894394 Atul Gupta 2018-03-31 464 {
a0894394 Atul Gupta 2018-03-31 465 struct tls_crypto_info *crypto_info, tmp_crypto_info;
a0894394 Atul Gupta 2018-03-31 466 struct chtls_sock *csk;
a0894394 Atul Gupta 2018-03-31 467 int keylen;
a0894394 Atul Gupta 2018-03-31 468 int rc = 0;
a0894394 Atul Gupta 2018-03-31 469
a0894394 Atul Gupta 2018-03-31 470 csk = rcu_dereference_sk_user_data(sk);
a0894394 Atul Gupta 2018-03-31 471
a0894394 Atul Gupta 2018-03-31 472 if (!optval || optlen < sizeof(*crypto_info)) {
a0894394 Atul Gupta 2018-03-31 473 rc = -EINVAL;
a0894394 Atul Gupta 2018-03-31 474 goto out;
a0894394 Atul Gupta 2018-03-31 475 }
a0894394 Atul Gupta 2018-03-31 476
a0894394 Atul Gupta 2018-03-31 477 rc = copy_from_user(&tmp_crypto_info, optval, sizeof(*crypto_info));
a0894394 Atul Gupta 2018-03-31 478 if (rc) {
a0894394 Atul Gupta 2018-03-31 479 rc = -EFAULT;
a0894394 Atul Gupta 2018-03-31 480 goto out;
a0894394 Atul Gupta 2018-03-31 481 }
a0894394 Atul Gupta 2018-03-31 482
a0894394 Atul Gupta 2018-03-31 483 /* check version */
a0894394 Atul Gupta 2018-03-31 484 if (tmp_crypto_info.version != TLS_1_2_VERSION) {
a0894394 Atul Gupta 2018-03-31 485 rc = -ENOTSUPP;
a0894394 Atul Gupta 2018-03-31 486 goto out;
a0894394 Atul Gupta 2018-03-31 487 }
a0894394 Atul Gupta 2018-03-31 488
a0894394 Atul Gupta 2018-03-31 489 crypto_info = (struct tls_crypto_info *)&csk->tlshws.crypto_info;
a0894394 Atul Gupta 2018-03-31 490
a0894394 Atul Gupta 2018-03-31 491 switch (tmp_crypto_info.cipher_type) {
a0894394 Atul Gupta 2018-03-31 492 case TLS_CIPHER_AES_GCM_128: {
183b5e3e Wenwen Wang 2018-05-05 493 /* Obtain version and type from previous copy */
183b5e3e Wenwen Wang 2018-05-05 494 crypto_info[0] = tmp_crypto_info;
183b5e3e Wenwen Wang 2018-05-05 495 /* Now copy the following data */
183b5e3e Wenwen Wang 2018-05-05 @496 rc = copy_from_user(crypto_info + sizeof(*crypto_info),
183b5e3e Wenwen Wang 2018-05-05 497 optval + sizeof(*crypto_info),
183b5e3e Wenwen Wang 2018-05-05 498 sizeof(struct tls12_crypto_info_aes_gcm_128)
183b5e3e Wenwen Wang 2018-05-05 499 - sizeof(*crypto_info));
a0894394 Atul Gupta 2018-03-31 500
a0894394 Atul Gupta 2018-03-31 501 if (rc) {
a0894394 Atul Gupta 2018-03-31 502 rc = -EFAULT;
a0894394 Atul Gupta 2018-03-31 503 goto out;
a0894394 Atul Gupta 2018-03-31 504 }
a0894394 Atul Gupta 2018-03-31 505
a0894394 Atul Gupta 2018-03-31 506 keylen = TLS_CIPHER_AES_GCM_128_KEY_SIZE;
a0894394 Atul Gupta 2018-03-31 507 rc = chtls_setkey(csk, keylen, optname);
a0894394 Atul Gupta 2018-03-31 508 break;
a0894394 Atul Gupta 2018-03-31 509 }
a0894394 Atul Gupta 2018-03-31 510 default:
a0894394 Atul Gupta 2018-03-31 511 rc = -EINVAL;
a0894394 Atul Gupta 2018-03-31 512 goto out;
a0894394 Atul Gupta 2018-03-31 513 }
a0894394 Atul Gupta 2018-03-31 514 out:
a0894394 Atul Gupta 2018-03-31 515 return rc;
a0894394 Atul Gupta 2018-03-31 516 }
a0894394 Atul Gupta 2018-03-31 517
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
next prev parent reply other threads:[~2018-05-07 10:40 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-05 18:53 [PATCH] crypto: chtls - fix a missing-check bug Wenwen Wang
2018-05-07 10:39 ` Dan Carpenter [this message]
2018-05-18 19:55 Wenwen Wang
2018-05-26 16:27 ` Herbert Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180507103954.d3gfgyjnce2ctp4p@mwanda \
--to=dan.carpenter@oracle.com \
--cc=atul.gupta@chelsio.com \
--cc=davem@davemloft.net \
--cc=harsh@chelsio.com \
--cc=herbert@gondor.apana.org.au \
--cc=kbuild-all@01.org \
--cc=kbuild@01.org \
--cc=kjlu@umn.edu \
--cc=leedom@chelsio.com \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=wang6495@umn.edu \
--cc=werner@chelsio.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).