crypto: algif_aead - fix uninitialized ctx->init (21dfbcd1) · Commits · 戴 / test

In skcipher_accept_parent_nokey() the whole af_alg_ctx structure is cleared by memset() after allocation, so add such memset() also to aead_accept_parent_nokey() so that the new "init" field is also initialized to zero. Without that the initial ctx->init checks might randomly return true and cause errors. While there, also remove the redundant zero assignments in both functions. Found via libkcapi testsuite. Cc: Stephan Mueller <smueller@chronox.de> Fixes: ("crypto: algif_aead - Only wake up when ctx->more is zero") Suggested-by:

Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:

Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by:

Herbert Xu <herbert@gondor.apana.org.au>

crypto/algif_aead.c

+0 −6

Original line number	Diff line number	Diff line
		@@ -558,12 +558,6 @@ static int aead_accept_parent_nokey(void private, struct sock sk)

		INIT_LIST_HEAD(&ctx->tsgl_list);
		ctx->len = len;
		ctx->used = 0;
		atomic_set(&ctx->rcvused, 0);
		ctx->more = 0;
		ctx->merge = 0;
		ctx->enc = 0;
		ctx->aead_assoclen = 0;
		crypto_init_wait(&ctx->wait);

		ask->private = ctx;

crypto/algif_skcipher.c

+1 −6

Original line number	Diff line number	Diff line
		@@ -333,6 +333,7 @@ static int skcipher_accept_parent_nokey(void private, struct sock sk)
		ctx = sock_kmalloc(sk, len, GFP_KERNEL);
		if (!ctx)
		return -ENOMEM;
		memset(ctx, 0, len);

		ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm),
		GFP_KERNEL);
		@@ -340,16 +341,10 @@ static int skcipher_accept_parent_nokey(void private, struct sock sk)
		sock_kfree_s(sk, ctx, len);
		return -ENOMEM;
		}

		memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm));

		INIT_LIST_HEAD(&ctx->tsgl_list);
		ctx->len = len;
		ctx->used = 0;
		atomic_set(&ctx->rcvused, 0);
		ctx->more = 0;
		ctx->merge = 0;
		ctx->enc = 0;
		crypto_init_wait(&ctx->wait);

		ask->private = ctx;

Admin message