FAILED: patch "[PATCH] crypto: virtio: Fix src/dst scatterlist calculation in" failed to apply to 5.4-stable tree
Subsystems (4)
[email protected]
maintainerThe patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b02989f37fc5e865ceeee9070907e4493b3a21e2 Mon Sep 17 00:00:00 2001
From: "Longpeng(Mike)" <[email protected]>
Date: Tue, 2 Jun 2020 15:04:59 +0800
Subject: [PATCH] crypto: virtio: Fix src/dst scatterlist calculation in
__virtio_crypto_skcipher_do_req()
The system will crash when the users insmod crypto/tcrypt.ko with mode=38 ( testing "cts(cbc(aes))" ).
Usually the next entry of one sg will be @sg@ + 1, but if this sg element is part of a chained scatterlist, it could jump to the start of a new scatterlist array. Fix it by sg_next() on calculation of src/dst scatterlist.
drivers/crypto/virtio/virtio_crypto_algs.c +10 -5
@@ -350,13 +350,18 @@ __virtio_crypto_skcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req,int err;unsigned long flags;struct scatterlist outhdr, iv_sg, status_sg, **sgs; -int i;u64 dst_len;unsigned int num_out =0 , num_in =0 ;int sg_total;uint8_t *iv; +struct scatterlist *sg; src_nents =sg_nents_for_len (req->src, req->cryptlen); +if (src_nents <0 ) { +pr_err ("Invalid number of src SG.\n" ); +return src_nents; + } + dst_nents =sg_nents (req->dst); pr_debug("virtio_crypto: Number of sgs (src_nents: %d, dst_nents: %d)\n",
@@ -442,12 +447,12 @@ __virtio_crypto_skcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req, vc_sym_req->iv = iv;/* Source data */ -for (i =0 ; i < src_nents; i++) - sgs[num_out++] = &req->src[i]; +for (sg = req->src; src_nents; sg =sg_next (sg), src_nents--) + sgs[num_out++] = sg;/* Destination data */ -for (i =0 ; i < dst_nents; i++) - sgs[num_out + num_in++] = &req->dst[i]; +for (sg = req->dst; sg; sg =sg_next (sg)) + sgs[num_out + num_in++] = sg;/* Status */ sg_init_one (&status_sg, &vc_req->status,sizeof (vc_req->status));
Sasha Levin
maintainerQuoted 26 lines · On Mon, Jun 15, 2020 at 10:19:45PM +0200, [email protected] wrote:
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From
b02989f37fc5e865ceeee9070907e4493b3a21e2Mon Sep 17 00:00:00 2001
From: "Longpeng(Mike)" <[email protected]>
Date: Tue, 2 Jun 2020 15:04:59 +0800
Subject: [PATCH] crypto: virtio: Fix src/dst scatterlist calculation in__virtio_crypto_skcipher_do_req()The system will crash when the users insmod
crypto/tcrypt.kowith mode=38 ( testing "cts(cbc(aes))" ).Usually the next entry of one sg will be @sg@ + 1, but if this sg element is part of a chained scatterlist, it could jump to the start of a new scatterlist array. Fix it by
sg_next()on calculation of src/dst scatterlist.
Quoted 14 lines
Fixes dbaf0624ffa5 ("crypto: add virtio-crypto driver")Reported-by LABBE Corentin <[email protected]>Cc Herbert Xu <[email protected]>Cc "Michael S. Tsirkin" <[email protected]>Cc Jason Wang <[email protected]>Cc "David S. Miller" <[email protected]>Signed-off-by Gonglei <[email protected]>Signed-off-by Longpeng(Mike) <[email protected]>Signed-off-by Michael S. Tsirkin <[email protected]>
I've worked around missing eee1d6fca0a0 ("crypto: virtio - switch to skcipher API") and queued it for 5.4, 4.19, and 4.14.
Signature · 2 lines
Thanks, Sasha