Received: by 2002:a25:f815:0:0:0:0:0 with SMTP id u21csp2256314ybd; Mon, 24 Jun 2019 03:25:05 -0700 (PDT) X-Google-Smtp-Source: APXvYqwSQuFlDOkLUn6ICF8B7uppUNJzuf3vfntuIXU93ULn6tm8wgI0KFbNs5p11rgntgGlzweL X-Received: by 2002:a17:902:b20d:: with SMTP id t13mr33182144plr.229.1561371905037; Mon, 24 Jun 2019 03:25:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561371905; cv=none; d=google.com; s=arc-20160816; b=hJM15BDFl++HMOqx+gY3lo2YLZcHWUrrNZj6Vnax24yOVg+sHiA+8ipDst7AnGbJ0H CJM1WrTkzPa9kNX1Sm2S7XaTMCwsDeRg9HxF2b7J1+tQuMcBb/dveQun3ZMyXjv72tOT OMNCfGH7H/4AAWpYhHH43PleFFf6r3bk/E/vTicpZaipgxiSHmOo50TvmpdFMVOgJDPt pdCUORl+jd9m/BFNKUaVsZEG/QCHNvcvfDHj9FBuAC3hIbydWVVyphU2X2xI5G1pAAAb mMI68tjHvzZUtmxy+1Snt+0+VVAssTVRE+yk7AukXIGVjNVxf4LaIb9AIJFU5kIXzhvM pEcw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=1EmUYrPs82PyU14FaA8mChGqYUjyv4sBl+O+5MCWIb0=; b=N34A5lB9cVs/Y8Yi43Yo9ay9IVhzjNljvdBmZZXzICU6Yf9bIL/PkzyKMycviVuLkB XJvY6mqxzYSuB1qClk1D70tOgM2ilxFHh7UYEOfFO+OsXHr24wzyLNi90C+wQTwA5bWh dga5u6k9AqHzjHrK3pzHbQAgM40hclrqL9n9zd9aBtwveviOvdnNoptsk9WhV15Gcvot bbiHCbYmV0iHAwijPMI4EIWmnFAvXGg/iB+mamdDPDsz3b6/Qdh7CXFNfJnB0Ficlkco objJxwsU+wXmT76mQIGJBQilxGAcQd68YNdumw0WqW8Izd2uuYLUFSUCsyhnO60yE0fJ jq1g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=wiOa16g8; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a2si9231742pgt.217.2019.06.24.03.24.49; Mon, 24 Jun 2019 03:25:05 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=wiOa16g8; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730930AbfFXKV7 (ORCPT + 99 others); Mon, 24 Jun 2019 06:21:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:57722 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730881AbfFXKV4 (ORCPT ); Mon, 24 Jun 2019 06:21:56 -0400 Received: from localhost (f4.8f.5177.ip4.static.sl-reverse.com [119.81.143.244]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E6DE121537; Mon, 24 Jun 2019 10:21:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1561371715; bh=SVo2cDBHNSPxRRWoOWenBYh5CpjtewbwIcvBbQUS6gM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wiOa16g8+kmWiOT2jOgSiPxL/9fBkKTek91TTt0bEGOEHUYzcyiRaxCE5f/e6xUhm HFAWzemX2qQSbTGH4HlcNsUXnj0r/9qM1C73MbiHrJiotWbaEEda5O0PNNmWXeJak7 GBG/Pnbk/ezZKT/IZI7ou3vaaMknZORXp9XMXepo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jouni Malinen , Johannes Berg Subject: [PATCH 5.1 120/121] mac80211: Do not use stack memory with scatterlist for GMAC Date: Mon, 24 Jun 2019 17:57:32 +0800 Message-Id: <20190624092326.739934714@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190624092320.652599624@linuxfoundation.org> References: <20190624092320.652599624@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jouni Malinen commit a71fd9dac23613d96ba3c05619a8ef4fd6cdf9b9 upstream. ieee80211_aes_gmac() uses the mic argument directly in sg_set_buf() and that does not allow use of stack memory (e.g., BUG_ON() is hit in sg_set_buf() with CONFIG_DEBUG_SG). BIP GMAC TX side is fine for this since it can use the skb data buffer, but the RX side was using a stack variable for deriving the local MIC value to compare against the received one. Fix this by allocating heap memory for the mic buffer. This was found with hwsim test case ap_cipher_bip_gmac_128 hitting that BUG_ON() and kernel panic. Cc: stable@vger.kernel.org Signed-off-by: Jouni Malinen Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/mac80211/wpa.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/net/mac80211/wpa.c +++ b/net/mac80211/wpa.c @@ -1175,7 +1175,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); struct ieee80211_key *key = rx->key; struct ieee80211_mmie_16 *mmie; - u8 aad[GMAC_AAD_LEN], mic[GMAC_MIC_LEN], ipn[6], nonce[GMAC_NONCE_LEN]; + u8 aad[GMAC_AAD_LEN], *mic, ipn[6], nonce[GMAC_NONCE_LEN]; struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; if (!ieee80211_is_mgmt(hdr->frame_control)) @@ -1206,13 +1206,18 @@ ieee80211_crypto_aes_gmac_decrypt(struct memcpy(nonce, hdr->addr2, ETH_ALEN); memcpy(nonce + ETH_ALEN, ipn, 6); + mic = kmalloc(GMAC_MIC_LEN, GFP_ATOMIC); + if (!mic) + return RX_DROP_UNUSABLE; if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce, skb->data + 24, skb->len - 24, mic) < 0 || crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { key->u.aes_gmac.icverrors++; + kfree(mic); return RX_DROP_UNUSABLE; } + kfree(mic); } memcpy(key->u.aes_gmac.rx_pn, ipn, 6);