Commit 06817176 authored by Sebastian Siewior's avatar Sebastian Siewior Committed by Herbert Xu

[CRYPTO] api: fix writting into unallocated memory in setkey_aligned

setkey_unaligned() commited in ca7c3938
overwrites unallocated memory in the following memset() because
I used the wrong buffer length.
Signed-off-by: default avatarSebastian Siewior <sebastian@breakpoint.cc>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent d4ac2477
...@@ -35,7 +35,7 @@ static int setkey_unaligned(struct crypto_ablkcipher *tfm, const u8 *key, unsign ...@@ -35,7 +35,7 @@ static int setkey_unaligned(struct crypto_ablkcipher *tfm, const u8 *key, unsign
alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
memcpy(alignbuffer, key, keylen); memcpy(alignbuffer, key, keylen);
ret = cipher->setkey(tfm, alignbuffer, keylen); ret = cipher->setkey(tfm, alignbuffer, keylen);
memset(alignbuffer, 0, absize); memset(alignbuffer, 0, keylen);
kfree(buffer); kfree(buffer);
return ret; return ret;
} }
......
...@@ -352,7 +352,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key, unsigned int ...@@ -352,7 +352,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key, unsigned int
alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
memcpy(alignbuffer, key, keylen); memcpy(alignbuffer, key, keylen);
ret = cipher->setkey(tfm, alignbuffer, keylen); ret = cipher->setkey(tfm, alignbuffer, keylen);
memset(alignbuffer, 0, absize); memset(alignbuffer, 0, keylen);
kfree(buffer); kfree(buffer);
return ret; return ret;
} }
......
...@@ -36,7 +36,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key, unsigned int ...@@ -36,7 +36,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key, unsigned int
alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
memcpy(alignbuffer, key, keylen); memcpy(alignbuffer, key, keylen);
ret = cia->cia_setkey(tfm, alignbuffer, keylen); ret = cia->cia_setkey(tfm, alignbuffer, keylen);
memset(alignbuffer, 0, absize); memset(alignbuffer, 0, keylen);
kfree(buffer); kfree(buffer);
return ret; return ret;
......
...@@ -40,7 +40,7 @@ static int hash_setkey_unaligned(struct crypto_hash *crt, const u8 *key, ...@@ -40,7 +40,7 @@ static int hash_setkey_unaligned(struct crypto_hash *crt, const u8 *key,
alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
memcpy(alignbuffer, key, keylen); memcpy(alignbuffer, key, keylen);
ret = alg->setkey(crt, alignbuffer, keylen); ret = alg->setkey(crt, alignbuffer, keylen);
memset(alignbuffer, 0, absize); memset(alignbuffer, 0, keylen);
kfree(buffer); kfree(buffer);
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment