mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-30 07:34:12 +08:00
tls: fix skb_to_sgvec returning unhandled error.
The current code does not inspect the return value of skb_to_sgvec. This
can cause a nullptr kernel panic when the malformed sgvec is passed into
the crypto request.
Checking the return value of skb_to_sgvec and skipping decryption if it
is negative fixes this problem.
Fixes: c46234ebb4
("tls: RX path for ktls")
Acked-by: Dave Watson <davejwatson@fb.com>
Signed-off-by: Doron Roberts-Kedes <doronrk@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
c643ecf354
commit
52ee6ef36e
@ -701,6 +701,10 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
|
||||
nsg = skb_to_sgvec(skb, &sgin[1],
|
||||
rxm->offset + tls_ctx->rx.prepend_size,
|
||||
rxm->full_len - tls_ctx->rx.prepend_size);
|
||||
if (nsg < 0) {
|
||||
ret = nsg;
|
||||
goto out;
|
||||
}
|
||||
|
||||
tls_make_aad(ctx->rx_aad_ciphertext,
|
||||
rxm->full_len - tls_ctx->rx.overhead_size,
|
||||
@ -712,6 +716,7 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
|
||||
rxm->full_len - tls_ctx->rx.overhead_size,
|
||||
skb, sk->sk_allocation);
|
||||
|
||||
out:
|
||||
if (sgin != &sgin_arr[0])
|
||||
kfree(sgin);
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user