Received: by 2002:ac0:a5b6:0:0:0:0:0 with SMTP id m51-v6csp2532547imm; Thu, 7 Jun 2018 12:14:44 -0700 (PDT) X-Google-Smtp-Source: ADUXVKLoP6FyivvwV/k+UPFgWojxb1RhuRWEW40vdNIP9kNLUmwYbb2H/uMRnl7hfLjLcY6D2cif X-Received: by 2002:a63:a44a:: with SMTP id c10-v6mr2571475pgp.198.1528398884826; Thu, 07 Jun 2018 12:14:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1528398884; cv=none; d=google.com; s=arc-20160816; b=0hitNU0UYVKwjUXJhhcviLIteE2VXDIxcsel07ncBQ2N98bB13GVdG22rRvSdnALlb jP8oQmHF64JHdGbD3WhPgg9qXU2Qf0G1jpLBc5djpAgisYwqFJs3RmO84FWnS2YOTqx2 uvI3c++X+B8J5KTniOcliIAauc63CLiC6rACXgAxNt2RS3c4e+PyM9vG1rilgy8Vpr14 hr/vz6LpcohQ1Ryo6WOd2ZZ6Kj+M1/LeONZNZ45demsnLTs8Rm0IHowV3nwz3s70ACcU A/5f1bnuxt2WDH2f1xdxmPUuCRnlozLIWtS0gEvJ+GS6RMkkTg/pt9Le2pKZTQgrwHkq GiVQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=Rz2gxHAFm2JdlEJ5mqTNLUF4q/N9XHYCrjqPa8DflPY=; b=FuV6A6VPR3z8wm2W2Ep4Vc6ZX/3Q11Q2bKWSkNFoAay6UqfI6p7gtEwMqjgCrEcB82 StKD11wFfqfE/DCwuHFUy9qMIBQTzGgvXnNbzUO9yURyiwR4jhS9mix0p4t6Ld22Kw+E cqlwMUdDNFd+C4uvftys4b2iDLANIBxLwW6c0oanOAsvMH6ZiRAQurOry1XAuLYxr8qx WZAwSf5kE31QS9UtheYXhGm7fbL3FpSH5Tn6H6GozLxHqesYreQrRguv37nIer1oEs0m 0pIJIFTeACuoBCJHyBwFuEHMWSY12K+kt9CYV0vEW2j06MVjZ7f9z1o0njCwEpYSf8Bh WXvA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=U3CBS7/U; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j7-v6si26783648plk.334.2018.06.07.12.14.30; Thu, 07 Jun 2018 12:14:44 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=U3CBS7/U; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753079AbeFGTOK (ORCPT + 99 others); Thu, 7 Jun 2018 15:14:10 -0400 Received: from mail-pg0-f68.google.com ([74.125.83.68]:39370 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753014AbeFGTOH (ORCPT ); Thu, 7 Jun 2018 15:14:07 -0400 Received: by mail-pg0-f68.google.com with SMTP id w12-v6so5206096pgc.6; Thu, 07 Jun 2018 12:14:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Rz2gxHAFm2JdlEJ5mqTNLUF4q/N9XHYCrjqPa8DflPY=; b=U3CBS7/UlmZg5R9A6ojWsdAUfDVJ1goGhuE/CkLaQq4ZTa7OXSzejTMCeuJl/uwbz+ XrliZcTng1Q51wVdikw2WQdHc6baoimJtqq1smtultVhiYqJGhnw3FwjV3WM7+79rIfh W7mvqeG18vI4LbJl9VcjhrSK00CG13tRm/juRLXsiPXvf92u2u/MF5GIz/hGACAVcoaR xyqn94ucfSJoUvVp2wY6VtBdruBqGEXTqIqhpgcxlVmJQ2MkStvZKjfC/Zkxx/ME+0WW 7kdRpEPEPXgZKgn2mjnNaF63L2FYm9wqBirSGMs3gQKZN5cMG2vTVKx86uy9cPz0rY/w vqMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Rz2gxHAFm2JdlEJ5mqTNLUF4q/N9XHYCrjqPa8DflPY=; b=NjDcMk83xS8K3VOemrjvse/q1Olj+Rux64HpfKNf+c09Hbux7r06VdWFfGIMi45DR3 kqPrM5fkSInqD4RrRa8ztHy7xbG1sUb0MvjorBo4rcpmE0RQCO/PYqbqcpZ/AvLGLISA QU2sL1BgkJE4Q9eAQgUfXIMiHB1df9sNayWroN+3A5azrve9L7xi6M20cuAGEyxnaewj mvGMZeR1G60WzhiMI+GqgpmEiGY/MKGh42jNsqxwB99/I3tGMz3w18kwYWhn9dPkW2FX 596rMEr0NDhUqT4u8qa83G35weymn8+d2ac32HAaCQINo81WpU6L+CUgGRpq/aHj21wF puRA== X-Gm-Message-State: APt69E2MuVKcT6KsTjEGlKimSmNE9i3jzTpcuzKmlwmvS+GdGamFtBkN obX9r0S2+VRlsa5NHGMO85E= X-Received: by 2002:a65:4d91:: with SMTP id p17-v6mr2504257pgq.296.1528398846627; Thu, 07 Jun 2018 12:14:06 -0700 (PDT) Received: from ebiggers-linuxstation.kir.corp.google.com ([2620:15c:17:3:dc28:5c82:b905:e8a8]) by smtp.gmail.com with ESMTPSA id i67-v6sm18481648pgc.77.2018.06.07.12.14.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 07 Jun 2018 12:14:06 -0700 (PDT) From: Eric Biggers To: David Howells , James Morris , keyrings@vger.kernel.org, linux-security-module@vger.kernel.org Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Tycho Andersen , Kees Cook , Stephan Mueller , Eric Biggers Subject: [PATCH] dh key: fix rounding up KDF output length Date: Thu, 7 Jun 2018 12:12:01 -0700 Message-Id: <20180607191201.97080-1-ebiggers3@gmail.com> X-Mailer: git-send-email 2.17.1.1185.g55be947832-goog In-Reply-To: <0000000000009c221d056e0cf53a@google.com> References: <0000000000009c221d056e0cf53a@google.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Biggers Commit 383203eff718 ("dh key: get rid of stack allocated array") changed kdf_ctr() to assume that the length of key material to derive is a multiple of the digest size. The length was supposed to be rounded up accordingly. However, the round_up() macro was used which only gives the correct result on power-of-2 arguments, whereas not all hash algorithms have power-of-2 digest sizes. In some cases this resulted in a write past the end of the 'outbuf' buffer. Fix it by switching to roundup(), which works for non-power-of-2 inputs. Reported-by: syzbot+486f97f892efeb2075a3@syzkaller.appspotmail.com Reported-by: syzbot+29d17b7898b41ee120a5@syzkaller.appspotmail.com Reported-by: syzbot+8a608baf8751184ec727@syzkaller.appspotmail.com Reported-by: syzbot+d04e58bd384f1fe0b112@syzkaller.appspotmail.com Fixes: 383203eff718 ("dh key: get rid of stack allocated array") Signed-off-by: Eric Biggers --- security/keys/dh.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/security/keys/dh.c b/security/keys/dh.c index f7403821db7f0..b203f7758f976 100644 --- a/security/keys/dh.c +++ b/security/keys/dh.c @@ -142,6 +142,8 @@ static void kdf_dealloc(struct kdf_sdesc *sdesc) * The src pointer is defined as Z || other info where Z is the shared secret * from DH and other info is an arbitrary string (see SP800-56A section * 5.8.1.2). + * + * 'dlen' must be a multiple of the digest size. */ static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen, u8 *dst, unsigned int dlen, unsigned int zlen) @@ -205,8 +207,8 @@ static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc, { uint8_t *outbuf = NULL; int ret; - size_t outbuf_len = round_up(buflen, - crypto_shash_digestsize(sdesc->shash.tfm)); + size_t outbuf_len = roundup(buflen, + crypto_shash_digestsize(sdesc->shash.tfm)); outbuf = kmalloc(outbuf_len, GFP_KERNEL); if (!outbuf) { -- 2.17.1.1185.g55be947832-goog