mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-29 23:53:32 +00:00
tls: Use size_add() in call to struct_size()
[ Upstream commita2713257ee
] If, for any reason, the open-coded arithmetic causes a wraparound, the protection that `struct_size()` adds against potential integer overflows is defeated. Fix this by hardening call to `struct_size()` with `size_add()`. Fixes:b89fec54fd
("tls: rx: wrap decrypt params in a struct") Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
be25fc451e
commit
4c7f066b7b
1 changed files with 1 additions and 1 deletions
|
@ -1491,7 +1491,7 @@ static int tls_decrypt_sg(struct sock *sk, struct iov_iter *out_iov,
|
|||
*/
|
||||
aead_size = sizeof(*aead_req) + crypto_aead_reqsize(ctx->aead_recv);
|
||||
aead_size = ALIGN(aead_size, __alignof__(*dctx));
|
||||
mem = kmalloc(aead_size + struct_size(dctx, sg, n_sgin + n_sgout),
|
||||
mem = kmalloc(aead_size + struct_size(dctx, sg, size_add(n_sgin, n_sgout)),
|
||||
sk->sk_allocation);
|
||||
if (!mem) {
|
||||
err = -ENOMEM;
|
||||
|
|
Loading…
Reference in a new issue