From patchwork Mon Mar 21 13:26:15 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolai Stange X-Patchwork-Id: 8633021 X-Patchwork-Delegate: herbert@gondor.apana.org.au Return-Path: X-Original-To: patchwork-linux-crypto@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id DD29EC0553 for ; Mon, 21 Mar 2016 13:28:48 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E71E32026F for ; Mon, 21 Mar 2016 13:28:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E58F620263 for ; Mon, 21 Mar 2016 13:28:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753808AbcCUN2a (ORCPT ); Mon, 21 Mar 2016 09:28:30 -0400 Received: from mail-wm0-f66.google.com ([74.125.82.66]:33846 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756004AbcCUN0z (ORCPT ); Mon, 21 Mar 2016 09:26:55 -0400 Received: by mail-wm0-f66.google.com with SMTP id p65so22327823wmp.1; Mon, 21 Mar 2016 06:26:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=J/hLhRyR24EbJApEG8AnFpnj2M8z0AAfxhtHwjB27og=; b=n9UwgXmimYyIGRVAZMzwG98+0sd3ofmTdpDU6L4HGI8udWFeiVHimB+TKehKiAsPEu bgzl1V6/DYwRg8pydubEgoznG+x2QlaZIdB+8q+uoWOBBFCFYAyDCs2BlKS19ClX7UoQ klQDcAlKtR5ATzC9XrokytvKKp5foQs5qpUoBCkdf497GEJxKjmb7GGHKwYDcIzBeQD8 Trpjq8Q6gdLUNuFr+Xvt84mFaMDwwa2FTSNtOYEpJFcZXPqbEHfYz+A/ZxOeuCtYJ3Hf NIlYivp5jIGRz2UH4uX96zob7YZYaU/fF7Ws1Ni9jLn+c3PpXq1Q+VzPp+xIGoxRTrHx 0N3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=J/hLhRyR24EbJApEG8AnFpnj2M8z0AAfxhtHwjB27og=; b=iT0VdfU5UItNvds+WKQ2QauhrOYG/Ty2mhn1+IhTJiNKNq/tPqplKL+odjg7paUH7U dW3/VbU4IErfi+DgnVx+X4kiOcTqTpXmwWbPisrFsPt/e12i8HSOXc1KQDYnqGoV90Gk jEYILf+F0uo5N1t3Uhmw5Z1LVc9k9KUEB8IOqQrANL+I0ALCNrNFKuuMt8JE18zX6EAf sTd1nEdEBEl2/SPOPSUKvLOB9TS0eK0JkyRose2XWMHa7a/rCvczx8XUB9Qm/RztG0y6 uePyRpZCNpXQnTbsLcD12k42tD8b7yXvsfNc5p4Cj+dlpco5SbggKz+//adAuJYYJvgb skmw== X-Gm-Message-State: AD7BkJJjaUpIcBdb48csiR1Lcu6gVDzRz9035Oz/1e53jjI9oNKJY9NcbnEdDwHzSsEZZg== X-Received: by 10.194.123.35 with SMTP id lx3mr29843103wjb.132.1458566814208; Mon, 21 Mar 2016 06:26:54 -0700 (PDT) Received: from localhost (x55b18fc0.dyn.telefonica.de. [85.177.143.192]) by smtp.gmail.com with ESMTPSA id 8sm12482297wmk.13.2016.03.21.06.26.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 21 Mar 2016 06:26:53 -0700 (PDT) From: Nicolai Stange To: Herbert Xu , "David S. Miller" Cc: Tadeusz Struk , Michal Marek , Andrzej Zaborowski , Stephan Mueller , Arnd Bergmann , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Nicolai Stange Subject: [PATCH RESEND v2 14/14] lib/mpi: mpi_read_raw_from_sgl(): fix out-of-bounds buffer access Date: Mon, 21 Mar 2016 14:26:15 +0100 Message-Id: <1458566775-5239-15-git-send-email-nicstange@gmail.com> X-Mailer: git-send-email 2.7.3 In-Reply-To: <1458566775-5239-1-git-send-email-nicstange@gmail.com> References: <1458566775-5239-1-git-send-email-nicstange@gmail.com> Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Within the copying loop in mpi_read_raw_from_sgl(), the last input SGE's byte count gets artificially extended as follows: if (sg_is_last(sg) && (len % BYTES_PER_MPI_LIMB)) len += BYTES_PER_MPI_LIMB - (len % BYTES_PER_MPI_LIMB); Within the following byte copying loop, this causes reads beyond that SGE's allocated buffer: BUG: KASAN: slab-out-of-bounds in mpi_read_raw_from_sgl+0x331/0x650 at addr ffff8801e168d4d8 Read of size 1 by task systemd-udevd/721 [...] Call Trace: [] dump_stack+0xbc/0x117 [] ? _atomic_dec_and_lock+0x169/0x169 [] ? print_section+0x61/0xb0 [] print_trailer+0x179/0x2c0 [] object_err+0x34/0x40 [] kasan_report_error+0x307/0x8c0 [] ? kasan_unpoison_shadow+0x35/0x50 [] ? kasan_kmalloc+0x5e/0x70 [] kasan_report+0x71/0xa0 [] ? mpi_read_raw_from_sgl+0x331/0x650 [] __asan_load1+0x46/0x50 [] mpi_read_raw_from_sgl+0x331/0x650 [] rsa_verify+0x106/0x260 [] ? rsa_set_pub_key+0xf0/0xf0 [] ? sg_init_table+0x29/0x50 [] ? pkcs1pad_sg_set_buf+0xb2/0x2e0 [] pkcs1pad_verify+0x1f4/0x2b0 [] public_key_verify_signature+0x3a7/0x5e0 [] ? public_key_describe+0x80/0x80 [] ? keyring_search_aux+0x150/0x150 [] ? x509_request_asymmetric_key+0x114/0x370 [] ? kfree+0x220/0x370 [] public_key_verify_signature_2+0x32/0x50 [] verify_signature+0x7c/0xb0 [] pkcs7_validate_trust+0x42c/0x5f0 [] system_verify_data+0xca/0x170 [] ? top_trace_array+0x9b/0x9b [] ? __vfs_read+0x279/0x3d0 [] mod_verify_sig+0x1ff/0x290 [...] The exact purpose of the len extension isn't clear to me, but due to its form, I suspect that it's a leftover somehow accounting for leading zero bytes within the most significant output limb. Note however that without that len adjustement, the total number of bytes ever processed by the inner loop equals nbytes and thus, the last output limb gets written at this point. Thus the net effect of the len adjustement cited above is just to keep the inner loop running for some more iterations, namely < BYTES_PER_MPI_LIMB ones, reading some extra bytes from beyond the last SGE's buffer and discarding them afterwards. Fix this issue by purging the extension of len beyond the last input SGE's buffer length. Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") Signed-off-by: Nicolai Stange --- lib/mpi/mpicoder.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c index 3f114d2..0c534ac 100644 --- a/lib/mpi/mpicoder.c +++ b/lib/mpi/mpicoder.c @@ -484,9 +484,6 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) const u8 *buffer = sg_virt(sg) + lzeros; int len = sg->length - lzeros; - if (sg_is_last(sg) && (len % BYTES_PER_MPI_LIMB)) - len += BYTES_PER_MPI_LIMB - (len % BYTES_PER_MPI_LIMB); - for (x = 0; x < len; x++) { a <<= 8; a |= *buffer++;