crypto: algif_skcipher: rewind rounded output bytes
PATCH 1/1 crypto: algif_skcipher: rewind rounded output bytes
af_alg_get_rsgl() advances the receive iterator by the unrounded RX scatterlist length. For a continuing skcipher request, _skcipher_recvmsg() then rounds its local length down to a whole chunksize without restoring the iterator.
A later chunk starts after bytes which the provider never wrote, while the syscall returns only the processed length. When copy_splice_read() supplies non-zeroed pages and publishes that return as a dense prefix, the gap exposes stale bytes from a previous page lifetime.
With unprivileged xts(aes), a 31-byte MSG_MORE request followed by one final byte advances a 47-byte destination while returning 32 bytes. A hardened v7.2-rc5 image retained all 15 seeded stale bytes in 4,829 of 4,829 records. With init_on_alloc enabled, all 72,345 gap bytes observed were zero.
Rewind the iterator by the tail excluded during rounding, before rejecting a zero processed length. The crypto request uses only the rounded length; af_alg_free_resources() releases the entire RX list before another receive iteration.
The fixed target-like kernel returned byte-identical dense 48-byte output in 4,771 of 4,771 rounds. The unmodified kernel returned the vulnerable 32-byte short record in 2,409 of 2,409 rounds.
--- crypto/algif_skcipher.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
crypto/algif_skcipher.c +6 -2
@@ -135,12 +135,16 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,* full block size buffers. */ if (ctx->more || len < ctx->used) { -if (len < bs) { +size_t excess = len % bs; + + len -= excess; +iov_iter_revert (&msg->msg_iter, excess); + +if (!len) { err = -EINVAL ; goto free; } - len -= len % bs; cflags |=CRYPTO_SKCIPHER_REQ_NOTFINAL ; }
Signature · 1 line
2.55.0
Herbert Xu
maintainerQuoted 25 lines · Daehyeon Ko
af_alg_get_rsgl()advances the receive iterator by the unrounded RX scatterlist length. For a continuing skcipher request,_skcipher_recvmsg()then rounds its local length down to a whole chunksize without restoring the iterator.A later chunk starts after bytes which the provider never wrote, while the syscall returns only the processed length. When
copy_splice_read()supplies non-zeroed pages and publishes that return as a dense prefix, the gap exposes stale bytes from a previous page lifetime.With unprivileged xts(aes), a 31-byte
MSG_MORErequest followed by one final byte advances a 47-byte destination while returning 32 bytes. A hardened v7.2-rc5 image retained all 15 seeded stale bytes in 4,829 of 4,829 records. Withinit_on_allocenabled, all 72,345 gap bytes observed were zero.Rewind the iterator by the tail excluded during rounding, before rejecting a zero processed length. The crypto request uses only the rounded length;
af_alg_free_resources()releases the entire RX list before another receive iteration.The fixed target-like kernel returned byte-identical dense 48-byte output in 4,771 of 4,771 rounds. The unmodified kernel returned the vulnerable 32-byte short record in 2,409 of 2,409 rounds.
Quoted 7 lines
Fixes e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")Assisted-by LLMSigned-off-by Daehyeon Ko <[email protected]>--- crypto/algif_skcipher.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
Patch applied. Thanks.
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt