| From edaf28e996af69222b2cb40455dbb5459c2b875a Mon Sep 17 00:00:00 2001 |
| From: Eric Biggers <ebiggers@google.com> |
| Date: Tue, 9 Apr 2019 23:46:30 -0700 |
| Subject: crypto: salsa20 - don't access already-freed walk.iv |
| |
| From: Eric Biggers <ebiggers@google.com> |
| |
| commit edaf28e996af69222b2cb40455dbb5459c2b875a upstream. |
| |
| If the user-provided IV needs to be aligned to the algorithm's |
| alignmask, then skcipher_walk_virt() copies the IV into a new aligned |
| buffer walk.iv. But skcipher_walk_virt() can fail afterwards, and then |
| if the caller unconditionally accesses walk.iv, it's a use-after-free. |
| |
| salsa20-generic doesn't set an alignmask, so currently it isn't affected |
| by this despite unconditionally accessing walk.iv. However this is more |
| subtle than desired, and it was actually broken prior to the alignmask |
| being removed by commit b62b3db76f73 ("crypto: salsa20-generic - cleanup |
| and convert to skcipher API"). |
| |
| Since salsa20-generic does not update the IV and does not need any IV |
| alignment, update it to use req->iv instead of walk.iv. |
| |
| Fixes: 2407d60872dd ("[CRYPTO] salsa20: Salsa20 stream cipher") |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Eric Biggers <ebiggers@google.com> |
| Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| |
| --- |
| crypto/salsa20_generic.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/crypto/salsa20_generic.c |
| +++ b/crypto/salsa20_generic.c |
| @@ -186,7 +186,7 @@ static int encrypt(struct blkcipher_desc |
| blkcipher_walk_init(&walk, dst, src, nbytes); |
| err = blkcipher_walk_virt_block(desc, &walk, 64); |
| |
| - salsa20_ivsetup(ctx, walk.iv); |
| + salsa20_ivsetup(ctx, desc->info); |
| |
| while (walk.nbytes >= 64) { |
| salsa20_encrypt_bytes(ctx, walk.dst.virt.addr, |
