Commit 9f5594c9 authored by Russell King's avatar Russell King Committed by Herbert Xu

crypto: marvell/cesa - fix stack smashing in marvell/hash.c

Several of the algorithms in marvell/hash.c have a statesize of zero.
When an AF_ALG accept() on an already-accepted file descriptor to
calls into hash_accept(), this causes:

	char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req))];

to be zero-sized, but we still pass this to:

	err = crypto_ahash_export(req, state);

which proceeds to write to 'state' as if it was a "struct md5_state",
"struct sha1_state" etc.  Add the necessary initialisers for the
.statesize member.
Acked-by: default avatarBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent c4d007bc
...@@ -872,6 +872,7 @@ struct ahash_alg mv_md5_alg = { ...@@ -872,6 +872,7 @@ struct ahash_alg mv_md5_alg = {
.import = mv_cesa_md5_import, .import = mv_cesa_md5_import,
.halg = { .halg = {
.digestsize = MD5_DIGEST_SIZE, .digestsize = MD5_DIGEST_SIZE,
.statesize = sizeof(struct md5_state),
.base = { .base = {
.cra_name = "md5", .cra_name = "md5",
.cra_driver_name = "mv-md5", .cra_driver_name = "mv-md5",
...@@ -961,6 +962,7 @@ struct ahash_alg mv_sha1_alg = { ...@@ -961,6 +962,7 @@ struct ahash_alg mv_sha1_alg = {
.import = mv_cesa_sha1_import, .import = mv_cesa_sha1_import,
.halg = { .halg = {
.digestsize = SHA1_DIGEST_SIZE, .digestsize = SHA1_DIGEST_SIZE,
.statesize = sizeof(struct sha1_state),
.base = { .base = {
.cra_name = "sha1", .cra_name = "sha1",
.cra_driver_name = "mv-sha1", .cra_driver_name = "mv-sha1",
...@@ -1050,6 +1052,7 @@ struct ahash_alg mv_sha256_alg = { ...@@ -1050,6 +1052,7 @@ struct ahash_alg mv_sha256_alg = {
.import = mv_cesa_sha256_import, .import = mv_cesa_sha256_import,
.halg = { .halg = {
.digestsize = SHA256_DIGEST_SIZE, .digestsize = SHA256_DIGEST_SIZE,
.statesize = sizeof(struct sha256_state),
.base = { .base = {
.cra_name = "sha256", .cra_name = "sha256",
.cra_driver_name = "mv-sha256", .cra_driver_name = "mv-sha256",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment