Skip to contentSkip to conversation

crypto: chacha20poly1305: validate poly1305 template argument

PATCH In review Ren Wei 2 participants 2 messages May 26 – Jun 5 1 message not in the archive Crypto API

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Ren Wei

author
#1 lore raw

PATCH 1/1 crypto: chacha20poly1305: validate poly1305 template argument

From: Xiaonan Zhao <[email protected]>

chachapoly_create() still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always present and immediately passes it to strcmp().

When the argument is missing, crypto_attr_alg_name() returns an error pointer. Check for that before comparing the name so malformed template instantiations fail with an error instead of dereferencing the error pointer in strcmp().

This matches the surrounding Crypto API template pattern where crypto_attr_alg_name() results are validated before string-specific use.

Fixes a298765e28ad ("crypto: chacha20poly1305 - Use lib/crypto poly1305")
Cc [email protected]
Reported-by Yuan Tan <[email protected]>
Reported-by Zhengchuan Liang <[email protected]>
Reported-by Xin Liu <[email protected]>
Co-developed-by Luxing Yin <[email protected]>
Signed-off-by Luxing Yin <[email protected]>
Signed-off-by Xiaonan Zhao <[email protected]>
Signed-off-by Ren Wei <[email protected]>
---
 crypto/chacha20poly1305.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)
crypto/chacha20poly1305.c +9 -2
index b4b5a7198d84..27df9e1eb058 100644
@@ -375,6 +375,7 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb,
 	struct aead_instance *inst;
 	struct chachapoly_instance_ctx *ctx;
 	struct skcipher_alg_common *chacha;
+	const char *poly_name;
 	int err;
 
 	if (ivsize > CHACHAPOLY_IV_SIZE)

@@ -396,9 +397,15 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb,
 		goto err_free_inst;
 	chacha = crypto_spawn_skcipher_alg_common(&ctx->chacha);
 
+	poly_name = crypto_attr_alg_name(tb[2]);
+	if (IS_ERR(poly_name)) {
+		err = PTR_ERR(poly_name);
+		goto err_free_inst;
+	}
+
 	err = -EINVAL;
-	if (strcmp(crypto_attr_alg_name(tb[2]), "poly1305") &&
-	    strcmp(crypto_attr_alg_name(tb[2]), "poly1305-generic"))
+	if (strcmp(poly_name, "poly1305") &&
+	    strcmp(poly_name, "poly1305-generic"))
 		goto err_free_inst;
 	/* Need 16-byte IV size, including Initial Block Counter value */
 	if (chacha->ivsize != CHACHA_IV_SIZE)
Signature · 1 line
2.47.3
maintainer
#2 lore raw
Quoted 23 lines · Ren Wei

From: Xiaonan Zhao <[email protected]>

chachapoly_create() still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always present and immediately passes it to strcmp().

When the argument is missing, crypto_attr_alg_name() returns an error pointer. Check for that before comparing the name so malformed template instantiations fail with an error instead of dereferencing the error pointer in strcmp().

This matches the surrounding Crypto API template pattern where crypto_attr_alg_name() results are validated before string-specific use.

Fixes a298765e28ad ("crypto: chacha20poly1305 - Use lib/crypto poly1305")
Cc [email protected]
Reported-by Yuan Tan <[email protected]>
Reported-by Zhengchuan Liang <[email protected]>
Reported-by Xin Liu <[email protected]>
Co-developed-by Luxing Yin <[email protected]>
Signed-off-by Luxing Yin <[email protected]>
Signed-off-by Xiaonan Zhao <[email protected]>
Signed-off-by Ren Wei <[email protected]>
Quoted 3 lines
---
 crypto/chacha20poly1305.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

Patch applied. Thanks.

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt