diff options
| author | Attila Fülöp <[email protected]> | 2019-12-03 19:28:48 +0100 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2019-12-03 10:28:47 -0800 |
| commit | 54c8366e3984b710dc2ce99ffdce6dfb15e8eecf (patch) | |
| tree | 526a15d8aea550947de739f98abc9a85cbf6b6b3 /module/icp/core | |
| parent | 7af72863fd0c995ea15f903273f93072bcfebc09 (diff) | |
ICP: Fix null pointer dereference and use after free
In gcm_mode_decrypt_contiguous_blocks(), if vmem_alloc() fails,
bcopy is called with a NULL pointer destination and a length > 0.
This results in undefined behavior. Further ctx->gcm_pt_buf is
freed but not set to NULL, leading to a potential write after
free and a double free due to missing return value handling in
crypto_update_uio(). The code as is may write to ctx->gcm_pt_buf
in gcm_decrypt_final() and may free ctx->gcm_pt_buf again in
aes_decrypt_atomic().
The fix is to slightly rework error handling and check the return
value in crypto_update_uio().
Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: Tom Caputi <[email protected]>
Reviewed-by: Kjeld Schouten <[email protected]>
Signed-off-by: Attila Fülöp <[email protected]>
Closes #9659
Diffstat (limited to 'module/icp/core')
| -rw-r--r-- | module/icp/core/kcf_prov_lib.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/module/icp/core/kcf_prov_lib.c b/module/icp/core/kcf_prov_lib.c index 3cae872dd..b2f2530c0 100644 --- a/module/icp/core/kcf_prov_lib.c +++ b/module/icp/core/kcf_prov_lib.c @@ -207,9 +207,12 @@ crypto_update_uio(void *ctx, crypto_data_t *input, crypto_data_t *output, cur_len = MIN(uiop->uio_iov[vec_idx].iov_len - offset, length); - (cipher)(ctx, uiop->uio_iov[vec_idx].iov_base + offset, + int rv = (cipher)(ctx, uiop->uio_iov[vec_idx].iov_base + offset, cur_len, (input == output) ? NULL : output); + if (rv != CRYPTO_SUCCESS) { + return (rv); + } length -= cur_len; vec_idx++; offset = 0; |