From patchwork Mon Sep 16 07:44:22 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: George Rurikov X-Patchwork-Id: 829456 Received: from MSK-MAILEDGE.securitycode.ru (msk-mailedge.securitycode.ru [195.133.217.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 973EC13BC0D; Mon, 16 Sep 2024 08:02:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=195.133.217.143 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1726473740; cv=none; b=sKyrXyibXOozW+MiJcqa45wPkH1aUC9cX77m2XqaJJCP6L2M+2tWmjcULih644C7plj1s5G0pBjjIisQ/KRZlCCeY8DjYm6jKuwN4mW1jR8kUOMFCfGXNENBzkV8dFXibHr3ZB/YmZQ3yjU1p2yjAOAqcKGy/gPBIs/qeeWtdV4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1726473740; c=relaxed/simple; bh=L7LNEN4dXWHLIdcIwU+NC2VKJlX0MX/c0GeQFCA1Lo0=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=f6oklmPGBkojMFfqBfh6+tp1YyhhZRXQRErwZ+J0KrRIM0CRhzi6ostdrMcZgkeLuDjwjqajXb/sJwQkWDc0gYtjIGj7ZQueY3/XSzDGG2Ch+M06UijbohoYx1XG20ntPoVbf+KIE6WIezUoZlhkv4oZhnVwrona44NmGgb77s4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=securitycode.ru; spf=pass smtp.mailfrom=securitycode.ru; arc=none smtp.client-ip=195.133.217.143 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=securitycode.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=securitycode.ru From: George Rurikov To: Herbert Xu CC: MrRurikov , "David S . Miller" , , , , Subject: [PATCH] crypto: Fix logical operator in _aead_recvmsg() Date: Mon, 16 Sep 2024 10:44:22 +0300 Message-ID: <20240916074422.503645-1-g.ryurikov@securitycode.ru> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-crypto@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: MSK-EX1.Securitycode.ru (172.17.8.91) To MSK-EX2.Securitycode.ru (172.17.8.92) From: MrRurikov After having been compared to a NULL value at algif_aead.c:191, pointer 'tsgl_src' is passed as 2nd parameter in call to function 'crypto_aead_copy_sgl' at algif_aead.c:244, where it is dereferenced at algif_aead.c:85. Change logical operator from && to || because pointer 'tsgl_src' is NULL, then 'proccessed' will still be non-null Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: stable@vger.kernel.org Fixes: 2d97591ef43d ("crypto: af_alg - consolidation of duplicate code") Signed-off-by: MrRurikov --- crypto/algif_aead.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1 Заявление о конфиденциальности Данное электронное письмо и любые приложения к нему являются конфиденциальными и предназначены исключительно для адресата. Если Вы не являетесь адресатом данного письма, пожалуйста, уведомите немедленно отправителя, не раскрывайте содержание другим лицам, не используйте его в каких-либо целях, не храните и не копируйте информацию любым способом. diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c index 7d58cbbce4af..135f09a4b3f8 100644 --- a/crypto/algif_aead.c +++ b/crypto/algif_aead.c @@ -191,7 +191,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, if (tsgl_src) break; } - if (processed && !tsgl_src) { + if (processed || !tsgl_src) { err = -EFAULT; goto free; }