This push fixes a stack overflow in virtio.

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmXFsIAACgkQxycdCkmx
 i6di7g//b9Zu/mAl9HjbsNW4GtG+/VkOohVB2QRsg9GF8/AARmwU1+Ajo+vgeRa3
 ruur7MfqOwC4Mx6DLkxIsU7pPZTwjivkwK9XOvXlhQqGXilicz5q/lJJicwWVzb1
 ojJI3+zP0hPVUlROOjpe1wrrz0ycKJ3F7YroPdNrM82aYC7gCCoMnoOOtjbqHNwf
 dBbCeiNS9iYWc+w8O9sbdDNwK7NNvXYFgjh+ml3WVS2bgTp/BF6iOnh1ROJzzlY4
 MXp1ut7AlLbmGXQ3LoCu6bvIAM1JL1AiIKx9iQp0DLbcfM6ooCyQojSwIzqhZ1tf
 6q/I6biB4WIdh4QJ0fR9rCN4gVaYU5m/yq8VifR3zsS/UC7le1j8yO3zcnM7FGkk
 D/o8/0PpjjeXngF39u/GscKb5IjflLCSRaaaKvp5HAlj36d7mRdN93FMj31Cmvcp
 fFnYd7k36kBoR+zHrXIUnXoPScBl89dMA7ZS5x00HICo8OMrC41pPvn+0BnBeG+G
 b0SZR7HIXos24cZQjZ/Mmb86OI5KlSMr9oRWr8bNgBDRnMkPBWWCAtcK6SQdDuMi
 XzJsH/2gNiz4zgBz6bytpbETp4Q79rfVOvpcxx0+aFbowPw1SuIskVLpS32EPRSE
 v9mtUAhVAIwFMTmGoEqDDmLLI5Ao5jek1WB3ayyf1hxhhgZbN2Q=
 =Z1+W
 -----END PGP SIGNATURE-----

Merge tag 'v6.8-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fix from Herbert Xu:
 "Fix a stack overflow in virtio"

* tag 'v6.8-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: virtio/akcipher - Fix stack overflow on memcpy
This commit is contained in:
Linus Torvalds 2024-02-21 08:37:49 -08:00
commit d8be5a55b8
1 changed files with 3 additions and 2 deletions

View File

@ -104,7 +104,8 @@ static void virtio_crypto_dataq_akcipher_callback(struct virtio_crypto_request *
}
static int virtio_crypto_alg_akcipher_init_session(struct virtio_crypto_akcipher_ctx *ctx,
struct virtio_crypto_ctrl_header *header, void *para,
struct virtio_crypto_ctrl_header *header,
struct virtio_crypto_akcipher_session_para *para,
const uint8_t *key, unsigned int keylen)
{
struct scatterlist outhdr_sg, key_sg, inhdr_sg, *sgs[3];
@ -128,7 +129,7 @@ static int virtio_crypto_alg_akcipher_init_session(struct virtio_crypto_akcipher
ctrl = &vc_ctrl_req->ctrl;
memcpy(&ctrl->header, header, sizeof(ctrl->header));
memcpy(&ctrl->u, para, sizeof(ctrl->u));
memcpy(&ctrl->u.akcipher_create_session.para, para, sizeof(*para));
input = &vc_ctrl_req->input;
input->status = cpu_to_le32(VIRTIO_CRYPTO_ERR);