Skip to content

Commit 21dfbcd

Browse files
WOnder93herbertx
authored andcommitted
crypto: algif_aead - fix uninitialized ctx->init
In skcipher_accept_parent_nokey() the whole af_alg_ctx structure is cleared by memset() after allocation, so add such memset() also to aead_accept_parent_nokey() so that the new "init" field is also initialized to zero. Without that the initial ctx->init checks might randomly return true and cause errors. While there, also remove the redundant zero assignments in both functions. Found via libkcapi testsuite. Cc: Stephan Mueller <[email protected]> Fixes: f3c802a ("crypto: algif_aead - Only wake up when ctx->more is zero") Suggested-by: Herbert Xu <[email protected]> Signed-off-by: Ondrej Mosnacek <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
1 parent 3cbfe80 commit 21dfbcd

File tree

2 files changed

+1
-12
lines changed

2 files changed

+1
-12
lines changed

crypto/algif_aead.c

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -558,12 +558,6 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk)
558558

559559
INIT_LIST_HEAD(&ctx->tsgl_list);
560560
ctx->len = len;
561-
ctx->used = 0;
562-
atomic_set(&ctx->rcvused, 0);
563-
ctx->more = 0;
564-
ctx->merge = 0;
565-
ctx->enc = 0;
566-
ctx->aead_assoclen = 0;
567561
crypto_init_wait(&ctx->wait);
568562

569563
ask->private = ctx;

crypto/algif_skcipher.c

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -333,23 +333,18 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
333333
ctx = sock_kmalloc(sk, len, GFP_KERNEL);
334334
if (!ctx)
335335
return -ENOMEM;
336+
memset(ctx, 0, len);
336337

337338
ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm),
338339
GFP_KERNEL);
339340
if (!ctx->iv) {
340341
sock_kfree_s(sk, ctx, len);
341342
return -ENOMEM;
342343
}
343-
344344
memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm));
345345

346346
INIT_LIST_HEAD(&ctx->tsgl_list);
347347
ctx->len = len;
348-
ctx->used = 0;
349-
atomic_set(&ctx->rcvused, 0);
350-
ctx->more = 0;
351-
ctx->merge = 0;
352-
ctx->enc = 0;
353348
crypto_init_wait(&ctx->wait);
354349

355350
ask->private = ctx;

0 commit comments

Comments
 (0)