Eric Biggers 92eb6c3060 crypto: af_alg - avoid undefined behavior accessing salg_name ... Commit 3f69cc6076 ("crypto: af_alg - Allow arbitrarily long algorithm names") made the kernel start accepting arbitrarily long algorithm names in sockaddr_alg. However, the actual length of the salg_name field stayed at the original 64 bytes. This is broken because the kernel can access indices >= 64 in salg_name, which is undefined behavior -- even though the memory that is accessed is still located within the sockaddr structure. It would only be defined behavior if the array were properly marked as arbitrary-length (either by making it a flexible array, which is the recommended way these days, or by making it an array of length 0 or 1). We can't simply change salg_name into a flexible array, since that would break source compatibility with userspace programs that embed sockaddr_alg into another struct, or (more commonly) declare a sockaddr_alg like 'struct sockaddr_alg sa = { .salg_name = "foo" };'. One solution would be to change salg_name into a flexible array only when '#ifdef __KERNEL__'. However, that would keep userspace without an easy way to actually use the longer algorithm names. Instead, add a new structure 'sockaddr_alg_new' that has the flexible array field, and expose it to both userspace and the kernel. Make the kernel use it correctly in alg_bind(). This addresses the syzbot report "UBSAN: array-index-out-of-bounds in alg_bind" (https://syzkaller.appspot.com/bug?extid=92ead4eb8e26a26d465e). Reported-by: syzbot+92ead4eb8e26a26d465e@syzkaller.appspotmail.com Fixes: 3f69cc6076 ("crypto: af_alg - Allow arbitrarily long algorithm names") Cc: <stable@vger.kernel.org> # v4.12+ Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>		2020-11-06 14:29:11 +11:00
..
acpi	pci-v5.10-changes	2020-10-22 12:41:00 -07:00
asm-generic	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
clocksource
crypto	crypto: aead - add crypto_aead_driver_name()	2020-11-06 14:29:10 +11:00
drm	sound updates for 5.10	2020-10-15 11:07:44 -07:00
dt-bindings	ARM: Devicetree updates	2020-10-24 10:44:18 -07:00
keys
kunit	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
kvm	ARM:	2020-10-23 11:17:56 -07:00
linux	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
math-emu
media	ARM: SoC platform updates	2020-10-24 10:33:08 -07:00
memory
misc
net	Fixes for 5.10-rc1 from the networking tree:	2020-10-23 12:05:49 -07:00
pcmcia
ras	mm,hwpoison: introduce MF_MSG_UNSPLIT_THP	2020-10-16 11:11:17 -07:00
rdma	RDMA: Explicitly pass in the dma_device to ib_register_device	2020-10-16 13:53:46 -03:00
scsi	SCSI misc on 20201023	2020-10-23 16:19:02 -07:00
soc	ARM: SoC-related driver updates	2020-10-24 10:39:22 -07:00
sound	ASoC: Updates for v5.10	2020-10-12 16:08:57 +02:00
target
trace	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
uapi	crypto: af_alg - avoid undefined behavior accessing salg_name	2020-11-06 14:29:11 +11:00
vdso
video
xen	xen: branch for v5.10-rc1c	2020-10-25 10:55:35 -07:00