]> git.baikalelectronics.ru Git - kernel.git/commit
crypto: aesni - Fix out-of-bounds access of the data buffer in generic-gcm-aesni
authorJunaid Shahid <junaids@google.com>
Thu, 21 Dec 2017 01:08:37 +0000 (17:08 -0800)
committerHerbert Xu <herbert@gondor.apana.org.au>
Thu, 28 Dec 2017 06:56:51 +0000 (17:56 +1100)
commitdd444d5109e7104fa878457cbd3b4c4cc89c347c
treec23eaf1d4091c3c0a7fd91738457b5263c5567a2
parentd70a71a19917ddc882c43d0fd04bbd216626900a
crypto: aesni - Fix out-of-bounds access of the data buffer in generic-gcm-aesni

The aesni_gcm_enc/dec functions can access memory before the start of
the data buffer if the length of the data buffer is less than 16 bytes.
This is because they perform the read via a single 16-byte load. This
can potentially result in accessing a page that is not mapped and thus
causing the machine to crash. This patch fixes that by reading the
partial block byte-by-byte and optionally an via 8-byte load if the block
was at least 8 bytes.

Fixes: e8e4e4ba ("crypto: aesni - make non-AVX AES-GCM work with any aadlen")
Cc: <stable@vger.kernel.org>
Signed-off-by: Junaid Shahid <junaids@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
arch/x86/crypto/aesni-intel_asm.S