This is a note to let you know that I've just added the patch titled
crypto: gcm - Fix rfc4543 decryption crash
to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
crypto-gcm-fix-rfc4543-decryption-crash.patch
and it can be found in the queue-3.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From [email protected] Sun May 1 15:39:20 2016
From: Herbert Xu <[email protected]>
Date: Fri, 18 Mar 2016 22:42:40 +0800
Subject: crypto: gcm - Fix rfc4543 decryption crash
To: [email protected], Linux Crypto Mailing List
<[email protected]>, Jussi Kivilinna <[email protected]>,
[email protected]
Message-ID: <[email protected]>
Content-Disposition: inline
From: Herbert Xu <[email protected]>
This bug has already bee fixed upstream since 4.2. However, it
was fixed during the AEAD conversion so no fix was backported to
the older kernels.
When we do an RFC 4543 decryption, we will end up writing the
ICV beyond the end of the dst buffer. This should lead to a
crash but for some reason it was never noticed.
This patch fixes it by only writing back the ICV for encryption.
Fixes: d733ac90f9fe ("crypto: gcm - fix rfc4543 to handle async...")
Reported-by: Patrick Meyer <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
crypto/gcm.c | 3 +++
1 file changed, 3 insertions(+)
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -1173,6 +1173,9 @@ static struct aead_request *crypto_rfc45
aead_request_set_tfm(subreq, ctx->child);
aead_request_set_callback(subreq, req->base.flags, crypto_rfc4543_done,
req);
+ if (!enc)
+ aead_request_set_callback(subreq, req->base.flags,
+ req->base.complete, req->base.data);
aead_request_set_crypt(subreq, cipher, cipher, enc ? 0 : authsize, iv);
aead_request_set_assoc(subreq, assoc, assoclen);
Patches currently in stable-queue which might be from
[email protected] are
queue-3.14/crypto-gcm-fix-rfc4543-decryption-crash.patch
queue-3.14/crypto-ccp-prevent-information-leakage-on-export.patch
--
To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
