diff options
| author | Tom Lendacky <thomas.lendacky@amd.com> | 2016-04-13 10:52:25 -0500 |
|---|---|---|
| committer | Sasha Levin <sasha.levin@oracle.com> | 2016-05-08 21:21:51 -0400 |
| commit | 1e53b1951e8a48266144d3a79a6a03950111b717 (patch) | |
| tree | b0e36110d9976f55fa50e6d40aaeca91cf4af963 | |
| parent | 5630c73cc47a028e0d2c8ff298f73ba86226d4a3 (diff) | |
| download | lwn-1e53b1951e8a48266144d3a79a6a03950111b717.tar.gz lwn-1e53b1951e8a48266144d3a79a6a03950111b717.zip | |
crypto: ccp - Prevent information leakage on export
[ Upstream commit f709b45ec461b548c41a00044dba1f1b572783bf ]
Prevent information from leaking to userspace by doing a memset to 0 of
the export state structure before setting the structure values and copying
it. This prevents un-initialized padding areas from being copied into the
export area.
Cc: <stable@vger.kernel.org> # 3.14.x-
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
| -rw-r--r-- | drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 3 | ||||
| -rw-r--r-- | drivers/crypto/ccp/ccp-crypto-sha.c | 3 |
2 files changed, 6 insertions, 0 deletions
diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c index 5c93afb1841a..f10b4998937d 100644 --- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c +++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c @@ -206,6 +206,9 @@ static int ccp_aes_cmac_export(struct ahash_request *req, void *out) struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req); struct ccp_aes_cmac_exp_ctx state; + /* Don't let anything leak to 'out' */ + memset(&state, 0, sizeof(state)); + state.null_msg = rctx->null_msg; memcpy(state.iv, rctx->iv, sizeof(state.iv)); state.buf_count = rctx->buf_count; diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c index b368e985a086..ced9f38a8978 100644 --- a/drivers/crypto/ccp/ccp-crypto-sha.c +++ b/drivers/crypto/ccp/ccp-crypto-sha.c @@ -198,6 +198,9 @@ static int ccp_sha_export(struct ahash_request *req, void *out) struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req); struct ccp_sha_exp_ctx state; + /* Don't let anything leak to 'out' */ + memset(&state, 0, sizeof(state)); + state.type = rctx->type; state.msg_bits = rctx->msg_bits; state.first = rctx->first; |