crypto: af_alg - fix possible uninit-value in alg_bind() (a466856e) · Commits · 戴 / test

syzbot reported : BUG: KMSAN: uninit-value in alg_bind+0xe3/0xd90 crypto/af_alg.c:162 We need to check addr_len before dereferencing sa (or uaddr) Fixes: ("crypto: af_alg - whitelist mask and type") Signed-off-by:

Eric Dumazet <edumazet@google.com> Reported-by:

syzbot <syzkaller@googlegroups.com> Cc: Stephan Mueller <smueller@chronox.de> Cc: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:

David S. Miller <davem@davemloft.net>

crypto/af_alg.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -158,16 +158,16 @@ static int alg_bind(struct socket sock, struct sockaddr uaddr, int addr_len)
		void *private;
		int err;

		/* If caller uses non-allowed flag, return error. */
		if ((sa->salg_feat & ~allowed) \|\| (sa->salg_mask & ~allowed))
		return -EINVAL;

		if (sock->state == SS_CONNECTED)
		return -EINVAL;

		if (addr_len < sizeof(*sa))
		return -EINVAL;

		/* If caller uses non-allowed flag, return error. */
		if ((sa->salg_feat & ~allowed) \|\| (sa->salg_mask & ~allowed))
		return -EINVAL;

		sa->salg_type[sizeof(sa->salg_type) - 1] = 0;
		sa->salg_name[sizeof(sa->salg_name) + addr_len - sizeof(*sa) - 1] = 0;

Admin message