Patch "crypto: testmgr - fix out of bound read in __test_aead()" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

crypto: testmgr - fix out of bound read in __test_aead()

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
crypto-testmgr-fix-out-of-bound-read-in-__test_aead.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Jerome Marchand <[email protected]>
Date: Wed, 3 Feb 2016 13:58:12 +0100
Subject: crypto: testmgr - fix out of bound read in __test_aead()

From: Jerome Marchand <[email protected]>

commit abfa7f4357e3640fdee87dfc276fd0f379fb5ae6 upstream.

__test_aead() reads MAX_IVLEN bytes from template[i].iv, but the actual length of the initialisation vector can be shorter. The length of the IV is already calculated earlier in the function. Let's just reuses that. Also the IV length is currently calculated several time for no reason. Let's fix that too. This fix an out-of-bound error detected by KASan.

---
 crypto/testmgr.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -488,6 +488,8 @@ static int __test_aead(struct crypto_aea
 	aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
 				  tcrypt_complete, &result);
 
+	iv_len = crypto_aead_ivsize(tfm);
+
 	for (i = 0, j = 0; i < tcount; i++) {
 		if (template[i].np)
 			continue;

@@ -508,7 +510,6 @@ static int __test_aead(struct crypto_aea
 
 		memcpy(input, template[i].input, template[i].ilen);
 		memcpy(assoc, template[i].assoc, template[i].alen);
-		iv_len = crypto_aead_ivsize(tfm);
 		if (template[i].iv)
 			memcpy(iv, template[i].iv, iv_len);
 		else

@@ -617,7 +618,7 @@ static int __test_aead(struct crypto_aea
 		j++;
 
 		if (template[i].iv)
-			memcpy(iv, template[i].iv, MAX_IVLEN);
+			memcpy(iv, template[i].iv, iv_len);
 		else
 			memset(iv, 0, MAX_IVLEN);
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/crypto-testmgr-fix-out-of-bound-read-in-__test_aead.patch