Commit 3619dec5 authored Jun 26, 2018 by Eric Biggers Committed by James Morris Jun 26, 2018

dh key: fix rounding up KDF output length

Commit 383203ef ("dh key: get rid of stack allocated array") changed
kdf_ctr() to assume that the length of key material to derive is a
multiple of the digest size. The length was supposed to be rounded up
accordingly. However, the round_up() macro was used which only gives
the correct result on power-of-2 arguments, whereas not all hash
algorithms have power-of-2 digest sizes. In some cases this resulted in
a write past the end of the 'outbuf' buffer.

Fix it by switching to roundup(), which works for non-power-of-2 inputs.

Reported-by: <syzbot+486f97f892efeb2075a3@syzkaller.appspotmail.com>
Reported-by: <syzbot+29d17b7898b41ee120a5@syzkaller.appspotmail.com>
Reported-by: <syzbot+8a608baf8751184ec727@syzkaller.appspotmail.com>
Reported-by: <syzbot+d04e58bd384f1fe0b112@syzkaller.appspotmail.com>
Fixes: 383203ef ("dh key: get rid of stack allocated array")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Tycho Andersen <tycho@tycho.ws>
Signed-off-by: James Morris <james.morris@microsoft.com>

parent 2e20ce4a

security/keys/dh.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -142,6 +142,8 @@ static void kdf_dealloc(struct kdf_sdesc *sdesc)
		* The src pointer is defined as Z \|\| other info where Z is the shared secret
		* from DH and other info is an arbitrary string (see SP800-56A section
		* 5.8.1.2).
		*
		* 'dlen' must be a multiple of the digest size.
		*/
		static int kdf_ctr(struct kdf_sdesc sdesc, const u8 src, unsigned int slen,
		u8 *dst, unsigned int dlen, unsigned int zlen)
		@@ -205,7 +207,7 @@ static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc,
		{
		uint8_t *outbuf = NULL;
		int ret;
		size_t outbuf_len = round_up(buflen,
		size_t outbuf_len = roundup(buflen,
		crypto_shash_digestsize(sdesc->shash.tfm));

		outbuf = kmalloc(outbuf_len, GFP_KERNEL);