From patchwork Wed Oct 25 01:56:30 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Levin, Alexander \(Sasha Levin\)" X-Patchwork-Id: 117005 Delivered-To: patch@linaro.org Received: by 10.140.22.164 with SMTP id 33csp326984qgn; Tue, 24 Oct 2017 19:06:14 -0700 (PDT) X-Google-Smtp-Source: ABhQp+QSfJGhv40a+0IVF+EcJpktK2XhBr0/cyZX6R2eukA+bq/s7yfsucbcJFz82I9rNvzlTaXf X-Received: by 10.98.192.18 with SMTP id x18mr622823pff.280.1508897173981; Tue, 24 Oct 2017 19:06:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1508897173; cv=none; d=google.com; s=arc-20160816; b=Uwoc6CnWgK/UPPhuTjTg1XMEwLlMndUY/NPAKJ3G6pH0xSnXNw/knvxpOYBBdszRbF fOG5BXXmLa0zdJnpc51wj/1tn08madsrWqS+1Dega8mpc2TVKlnkuikY9u6t+far2K0j T6AsKM3Xivbn5NyPFheWJznnVb8/ejSUHGZG7FgZQel5RLaAxlkIRDpeqJCbldMJfX02 1CSaQ3WjLCJTHRoxWiK0j16eUo8McxY5emHMAET/38rYHyy0xvPEy1XrOpt0hb63+c14 BrjTONgQLLCT0COtN6cr80Lr0hECbADCRMGYm8yrog2782OXRKQTg1Larq2LpvSfcbse G6dA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:content-transfer-encoding :content-language:accept-language:in-reply-to:references:message-id :date:thread-index:thread-topic:subject:to:dkim-signature :dkim-signature:cc:from:dkim-signature:arc-authentication-results; bh=bF4Da5ERKPgfaLwb8wMoQCSFvq4c36oovwndQt0PTXY=; b=KgU+LyGtfNQKwWaevHPbtPipniGXLQP3sYDAQmklhedxEFYoHC6WLmIZNjHylxbB8U r3vWbiTc0NcY9+ylbSwA4TeYj82BLSXcll8xgZJp2zt+wafdSMQUZRFUB4PdiODA7Dfr vGqC91tc2YJNk8XqRd7OHvG7QqVcNeYerOJZn6oJe0PNAnydH3mA5SaDMcwRrUC3vHnm x01FCQMkNmFfIMRMRx5Q8MjhYOnTYyWEesxRTnieuBPxiM12LbE2fo+S/KB8HDykS8f1 sggi/zxI0aoZr7aLEajKPESQxm5kRjPHETu/si712RKQKe+MFNxx6jAZh29iV0QFEzPE s86g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@verizon.com header.s=corp header.b=tcgot1TL; dkim=fail header.i=@verizon.com header.s=corp header.b=jD/zo2Au; dkim=fail header.i=@verizon.com header.s=corp header.b=jD/zo2Au; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=verizon.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 184si1094577pfg.515.2017.10.24.19.06.13; Tue, 24 Oct 2017 19:06:13 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@verizon.com header.s=corp header.b=tcgot1TL; dkim=fail header.i=@verizon.com header.s=corp header.b=jD/zo2Au; dkim=fail header.i=@verizon.com header.s=corp header.b=jD/zo2Au; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=verizon.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932600AbdJYCGK (ORCPT + 9 others); Tue, 24 Oct 2017 22:06:10 -0400 Received: from omzsmtpe01.verizonbusiness.com ([199.249.25.210]:48424 "EHLO omzsmtpe01.verizonbusiness.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751831AbdJYB6M (ORCPT ); Tue, 24 Oct 2017 21:58:12 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=verizon.com; i=@verizon.com; q=dns/txt; s=corp; t=1508896692; x=1540432692; h=from:cc:to:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=Du4gKJn9A4pFUkM1Q6Ga1C3pe7xXtnbixbHHUZYvzak=; b=tcgot1TLsBpM1rLYpoqrhCupXCRx5kt6kloA+AwZIiGx18hmPftH3F7x MnSihHgUxZtzyZVbmB4yGc+1pmrTXPf3RdVaRx+OW9BemLg5HUCn7mwK9 jkUzaQd1ABUNrDKntZevfgzA5tdYqrf1F+zaRCwWhqgt76c9HrJoDH/l8 8=; Received: from unknown (HELO fldsmtpi03.verizon.com) ([166.68.71.145]) by omzsmtpe01.verizonbusiness.com with ESMTP; 25 Oct 2017 01:58:09 +0000 From: "Levin, Alexander (Sasha Levin)" Cc: Gilad Ben-Yossef , Steffen Klassert , "Levin, Alexander (Sasha Levin)" Received: from rogue-10-255-192-101.rogue.vzwcorp.com (HELO atlantis.verizonwireless.com) ([10.255.192.101]) by fldsmtpi03.verizon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 25 Oct 2017 01:57:49 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=verizon.com; i=@verizon.com; q=dns/txt; s=corp; t=1508896669; x=1540432669; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=Du4gKJn9A4pFUkM1Q6Ga1C3pe7xXtnbixbHHUZYvzak=; b=jD/zo2AuZz+P9LqVkB4a3rbFVgDon2JRJJ0jR0qxbz8SAlmWyzMx3qQi ccwnN23mGlNty3fYmbfJvQcpV2r2G68KZOa/zioaPFUEtGKK/VeDBrqw6 P6vLiW5od4s4iVSU1xz4INDQe7O8FaAKWs9sKoxqC4LPIcKhBX9JxafoM s=; Received: from pioneer.tdc.vzwcorp.com (HELO eris.verizonwireless.com) ([10.254.88.34]) by atlantis.verizonwireless.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 24 Oct 2017 21:57:49 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=verizon.com; i=@verizon.com; q=dns/txt; s=corp; t=1508896669; x=1540432669; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=Du4gKJn9A4pFUkM1Q6Ga1C3pe7xXtnbixbHHUZYvzak=; b=jD/zo2AuZz+P9LqVkB4a3rbFVgDon2JRJJ0jR0qxbz8SAlmWyzMx3qQi ccwnN23mGlNty3fYmbfJvQcpV2r2G68KZOa/zioaPFUEtGKK/VeDBrqw6 P6vLiW5od4s4iVSU1xz4INDQe7O8FaAKWs9sKoxqC4LPIcKhBX9JxafoM s=; X-Host: pioneer.tdc.vzwcorp.com Received: from ohtwi1exh003.uswin.ad.vzwcorp.com ([10.144.218.45]) by eris.verizonwireless.com with ESMTP/TLS/AES128-SHA256; 25 Oct 2017 01:57:49 +0000 Received: from tbwexch26apd.uswin.ad.vzwcorp.com (153.114.162.50) by OHTWI1EXH003.uswin.ad.vzwcorp.com (10.144.218.45) with Microsoft SMTP Server (TLS) id 14.3.248.2; Tue, 24 Oct 2017 21:57:49 -0400 Received: from OMZP1LUMXCA19.uswin.ad.vzwcorp.com (144.8.22.197) by tbwexch26apd.uswin.ad.vzwcorp.com (153.114.162.50) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Tue, 24 Oct 2017 21:57:48 -0400 Received: from OMZP1LUMXCA17.uswin.ad.vzwcorp.com (144.8.22.195) by OMZP1LUMXCA19.uswin.ad.vzwcorp.com (144.8.22.197) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Tue, 24 Oct 2017 20:57:46 -0500 Received: from OMZP1LUMXCA17.uswin.ad.vzwcorp.com ([144.8.22.195]) by OMZP1LUMXCA17.uswin.ad.vzwcorp.com ([144.8.22.195]) with mapi id 15.00.1263.000; Tue, 24 Oct 2017 20:57:46 -0500 To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" Subject: [PATCH AUTOSEL for 3.18 12/15] IPsec: do not ignore crypto err in ah4 input Thread-Topic: [PATCH AUTOSEL for 3.18 12/15] IPsec: do not ignore crypto err in ah4 input Thread-Index: AQHTTTR5jmd1Kg5TpUODaRHZ2cES3w== Date: Wed, 25 Oct 2017 01:56:30 +0000 Message-ID: <20171025015622.24698-12-alexander.levin@verizon.com> References: <20171025015622.24698-1-alexander.levin@verizon.com> In-Reply-To: <20171025015622.24698-1-alexander.levin@verizon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.144.60.250] MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Gilad Ben-Yossef [ Upstream commit ebd89a2d0675f1325c2be5b7576fd8cb7e8defd0 ] ah4 input processing uses the asynchronous hash crypto API which supplies an error code as part of the operation completion but the error code was being ignored. Treat a crypto API error indication as a verification failure. While a crypto API reported error would almost certainly result in a memcpy of the digest failing anyway and thus the security risk seems minor, performing a memory compare on what might be uninitialized memory is wrong. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- net/ipv4/ah4.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.11.0 diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c index ac9a32ec3ee4..0157f09c0de9 100644 --- a/net/ipv4/ah4.c +++ b/net/ipv4/ah4.c @@ -270,6 +270,9 @@ static void ah_input_done(struct crypto_async_request *base, int err) int ihl = ip_hdrlen(skb); int ah_hlen = (ah->hdrlen + 2) << 2; + if (err) + goto out; + work_iph = AH_SKB_CB(skb)->tmp; auth_data = ah_tmp_auth(work_iph, ihl); icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);