crypto: algif_aead: deref after NULL
PATCH 1/1 crypto: algif_aead: deref after NULL
From: Alexandr Sapozhnikov <[email protected]>
After having been compared to a NULL value at algif_aead.c:191, pointer 'tsgl_src' is passed as 2nd parameter in call to function 'crypto_aead_copy_sgl' at algif_aead.c:244, where it is dereferenced at algif_aead.c:85.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- crypto/algif_aead.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/algif_aead.c +1 -1
@@ -191,7 +191,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,if (tsgl_src)break ; } -if (processed && !tsgl_src) { +if (processed || !tsgl_src) { err = -EFAULT ; goto free; }
Signature · 1 line
2.5.3
Herbert Xu
maintainerQuoted 19 lines · Alexander Sapozhnikov
From: Alexandr Sapozhnikov <[email protected]>
After having been compared to a NULL value at algif_aead.c:191, pointer '
tsgl_src' is passed as 2nd parameter in call to function 'crypto_aead_copy_sgl' at algif_aead.c:244, where it is dereferenced at algif_aead.c:85.Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by Alexandr Sapozhnikov <[email protected]>--- crypto/algif_aead.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)crypto/algif_aead.c +0
-0
crypto/algif_aead.c static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, · line 194
Quoted 5 lines
crypto/algif_aead.c +1
-1@@ -191,7 +191,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,if (tsgl_src)break ; } -if (processed && !tsgl_src) { +if (processed || !tsgl_src) {
I think this is a false positive. If processed is zero (which can only happen for encryption, i.e., a null message), tsgl_src won't be dereferenced by the Crypto API. For decryption processed is never zero as it always contains the authentication tag.
Cheers,
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt