| Message ID | 20220906084147.1423045-5-berrange@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | crypto: improve robustness of LUKS metadata validation | expand |
On Tue, Sep 06, 2022 at 09:41:40AM +0100, Daniel P. Berrangé wrote: > We already validate that LUKS keyslots don't overlap with the > header, or with each other. This closes the remain hole in remain -> remaining > validation of LUKS file regions. > > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> > --- > crypto/block-luks.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/crypto/block-luks.c b/crypto/block-luks.c > index 6ef9a89ffa..f22bc63e54 100644 > --- a/crypto/block-luks.c > +++ b/crypto/block-luks.c > @@ -572,6 +572,13 @@ qcrypto_block_luks_check_header(const QCryptoBlockLUKS *luks, Error **errp) > return -1; > } > > + if (luks->header.payload_offset_sector < > + DIV_ROUND_UP(QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET, > + QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) { > + error_setg(errp, "LUKS payload is overlapping with the header"); > + return -1; > + } > + > /* Check all keyslots for corruption */ > for (i = 0 ; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS ; i++) { > > -- > 2.37.2
diff --git a/crypto/block-luks.c b/crypto/block-luks.c index 6ef9a89ffa..f22bc63e54 100644 --- a/crypto/block-luks.c +++ b/crypto/block-luks.c @@ -572,6 +572,13 @@ qcrypto_block_luks_check_header(const QCryptoBlockLUKS *luks, Error **errp) return -1; } + if (luks->header.payload_offset_sector < + DIV_ROUND_UP(QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET, + QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) { + error_setg(errp, "LUKS payload is overlapping with the header"); + return -1; + } + /* Check all keyslots for corruption */ for (i = 0 ; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS ; i++) {
We already validate that LUKS keyslots don't overlap with the header, or with each other. This closes the remain hole in validation of LUKS file regions. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> --- crypto/block-luks.c | 7 +++++++ 1 file changed, 7 insertions(+)