Commit 3c3c32f8 authored by Eric Biggers's avatar Eric Biggers Committed by Richard Weinberger
Browse files

ubifs: fix wrong use of crypto_shash_descsize() 



crypto_shash_descsize() returns the size of the shash_desc context
needed to compute the hash, not the size of the hash itself.

crypto_shash_digestsize() would be correct, or alternatively using
c->hash_len and c->hmac_desc_len which already store the correct values.
But actually it's simpler to just use stack arrays, so do that instead.

Fixes: 49525e5e ("ubifs: Add helper functions for authentication support")
Fixes: da8ef65f ("ubifs: Authenticate replayed journal")
Cc: <stable@vger.kernel.org> # v4.20+
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Acked-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
parent ecf84096

fs/ubifs/auth.c

+4 −13
Original line number Diff line number Diff line
@@ -79,13 +79,9 @@ int ubifs_prepare_auth_node(struct ubifs_info *c, void *node, 
			     struct shash_desc *inhash)

{

	struct ubifs_auth_node *auth = node;

	u8 *hash;

	u8 hash[UBIFS_HASH_ARR_SZ];

	int err;



	hash = kmalloc(crypto_shash_descsize(c->hash_tfm), GFP_NOFS);

	if (!hash)

		return -ENOMEM;



	{

		SHASH_DESC_ON_STACK(hash_desc, c->hash_tfm);
@@ -94,21 +90,16 @@ int ubifs_prepare_auth_node(struct ubifs_info *c, void *node, 


		err = crypto_shash_final(hash_desc, hash);

		if (err)

			goto out;

			return err;

	}



	err = ubifs_hash_calc_hmac(c, hash, auth->hmac);

	if (err)

		goto out;

		return err;



	auth->ch.node_type = UBIFS_AUTH_NODE;

	ubifs_prepare_node(c, auth, ubifs_auth_node_sz(c), 0);



	err = 0;

out:

	kfree(hash);



	return err;

	return 0;

}



static struct shash_desc *ubifs_get_desc(const struct ubifs_info *c,

fs/ubifs/replay.c

+2 −11
Original line number Diff line number Diff line
@@ -601,18 +601,12 @@ static int authenticate_sleb(struct ubifs_info *c, struct ubifs_scan_leb *sleb, 
	struct ubifs_scan_node *snod;

	int n_nodes = 0;

	int err;

	u8 *hash, *hmac;

	u8 hash[UBIFS_HASH_ARR_SZ];

	u8 hmac[UBIFS_HMAC_ARR_SZ];



	if (!ubifs_authenticated(c))

		return sleb->nodes_cnt;



	hash = kmalloc(crypto_shash_descsize(c->hash_tfm), GFP_NOFS);

	hmac = kmalloc(c->hmac_desc_len, GFP_NOFS);

	if (!hash || !hmac) {

		err = -ENOMEM;

		goto out;

	}



	list_for_each_entry(snod, &sleb->nodes, list) {



		n_nodes++;
@@ -662,9 +656,6 @@ static int authenticate_sleb(struct ubifs_info *c, struct ubifs_scan_leb *sleb, 
		err = 0;

	}

out:

	kfree(hash);

	kfree(hmac);



	return err ? err : n_nodes - n_not_auth;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE