Wenwen Wang f16b613ca8 crypto: chtls - fix a missing-check bug ... In do_chtls_setsockopt(), the tls crypto info is first copied from the poiner 'optval' in userspace and saved to 'tmp_crypto_info'. Then the 'version' of the crypto info is checked. If the version is not as expected, i.e., TLS_1_2_VERSION, error code -ENOTSUPP is returned to indicate that the provided crypto info is not supported yet. Then, the 'cipher_type' field of the 'tmp_crypto_info' is also checked to see if it is TLS_CIPHER_AES_GCM_128. If it is, the whole struct of tls12_crypto_info_aes_gcm_128 is copied from the pointer 'optval' and then the function chtls_setkey() is invoked to set the key. Given that the 'optval' pointer resides in userspace, a malicious userspace process can race to change the data pointed by 'optval' between the two copies. For example, a user can provide a crypto info with TLS_1_2_VERSION and TLS_CIPHER_AES_GCM_128. After the first copy, the user can modify the 'version' and the 'cipher_type' fields to any versions and/or cipher types that are not allowed. This way, the user can bypass the checks, inject bad data to the kernel, cause chtls_setkey() to set a wrong key or other issues. This patch reuses the data copied in the first try so as to ensure these checks will not be bypassed. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>		2018-05-27 00:12:04 +08:00
..
accessibility	…
acpi	xen: fixes for 4.17-rc1	2018-04-12 11:04:35 -07:00
amba	…
android	…
ata	Merge branch 'for-4.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata	2018-04-03 17:42:25 -07:00
atm	…
auxdisplay	…
base	mm: check __highest_present_section_nr directly in memory_dev_init()	2018-04-11 10:28:31 -07:00
bcma	…
block	for-linus-20180413	2018-04-13 15:15:15 -07:00
bluetooth	…
bus	pci-v4.17-changes	2018-04-06 18:31:06 -07:00
cdrom	…
char	hwrng: n2 - fix spelling mistake: "restesting" -> "retesting"	2018-05-19 00:13:53 +08:00
clk	The large diff this time around is from the addition of a new clk driver	2018-04-13 15:51:06 -07:00
clocksource	ARM: SoC platform updates for 4.17	2018-04-05 21:21:08 -07:00
connector	…
cpufreq	cpufreq: Drop cpufreq_table_validate_and_show()	2018-04-10 08:40:45 +02:00
cpuidle	cpuidle: menu: Avoid selecting shallow states with stopped tick	2018-04-09 11:54:57 +02:00
crypto	crypto: chtls - fix a missing-check bug	2018-05-27 00:12:04 +08:00
dax	libnvdimm for 4.17	2018-04-10 10:25:57 -07:00
dca	…
devfreq	…
dio	…
dma	DMAengine updates for v4.17-rc1	2018-04-10 12:14:37 -07:00
dma-buf	…
edac	* Add NVDIMM support to EDAC (Tony Luck)	2018-04-05 14:21:13 -07:00
eisa	…
extcon	Char/Misc patches for 4.17-rc1	2018-04-04 20:07:20 -07:00
firewire	…
firmware	Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging	2018-04-13 16:32:16 -07:00
fmc	…
fpga	…
fsi	…
gpio	DeviceTree updates for 4.17:	2018-04-05 21:03:42 -07:00
gpu	amdgpu, omap and snd regression fix	2018-04-12 20:56:10 -07:00
hid	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid	2018-04-05 11:53:34 -07:00
hsi	…
hv	ARM:	2018-04-09 11:42:31 -07:00
hwmon	hwmon updates for v4.17	2018-04-09 19:59:54 -07:00
hwspinlock	…
hwtracing	Char/Misc patches for 4.17-rc1	2018-04-04 20:07:20 -07:00
i2c	i2c: add param sanity check to i2c_transfer()	2018-04-11 23:33:46 +02:00
ide	for-4.17/block-20180402	2018-04-05 14:27:02 -07:00
idle	…
iio	This is the bulk of GPIO changes for the v4.17 kernel cycle:	2018-04-05 09:51:41 -07:00
infiniband	Merge candidates for 4.17 merge window	2018-04-06 17:35:43 -07:00
input	Changes to chrome-platform for v4.17	2018-04-13 16:20:36 -07:00
iommu	IOMMU Updates for Linux v4.17	2018-04-11 18:50:41 -07:00
ipack	…
irqchip	IOMMU Updates for Linux v4.17	2018-04-11 18:50:41 -07:00
isdn	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2018-04-03 14:04:18 -07:00
leds	…
lightnvm	…
macintosh	powerpc updates for 4.17	2018-04-07 12:08:19 -07:00
mailbox	…
mcb	…
md	libnvdimm for 4.17	2018-04-10 10:25:57 -07:00
media	remoteproc updates for v4.17	2018-04-10 12:09:27 -07:00
memory	…
memstick	…
message	…
mfd	platform/chrome: mfd/cros_ec_dev: Add sysfs entry to set keyboard wake lid angle	2018-04-10 22:25:07 -07:00
misc	* Fix 2032 time access issues and new compiler warnings	2018-04-12 10:21:19 -07:00
mmc	MMC core:	2018-04-12 10:59:03 -07:00
mtd	This pull request contains updates for both UBI and UBIFS:	2018-04-11 16:39:34 -07:00
mux	…
net	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-04-12 11:09:05 -07:00
nfc	…
ntb	…
nubus	…
nvdimm	libnvdimm for 4.17	2018-04-10 10:25:57 -07:00
nvme	nvme: expand nvmf_check_if_ready checks	2018-04-12 09:58:27 -06:00
nvmem	Char/Misc patches for 4.17-rc1	2018-04-04 20:07:20 -07:00
of	Kbuild updates for v4.17 (2nd)	2018-04-15 17:21:30 -07:00
opp	…
oprofile	…
parisc	…
parport	Char/Misc patches for 4.17-rc1	2018-04-04 20:07:20 -07:00
pci	PCI: Remove messages about reassigning resources	2018-04-11 08:46:50 -05:00
pcmcia	Merge branch 'for-linus-sa1100' of git://git.armlinux.org.uk/~rmk/linux-arm	2018-04-09 09:26:36 -07:00
perf	ARM: SoC driver updates for 4.17	2018-04-05 21:29:35 -07:00
phy	ARM: SoC platform updates for 4.17	2018-04-05 21:21:08 -07:00
pinctrl	This is the bulk of GPIO changes for the v4.17 kernel cycle:	2018-04-05 09:51:41 -07:00
platform	Changes to chrome-platform for v4.17	2018-04-13 16:20:36 -07:00
pnp	…
power	ARM: SoC platform updates for 4.17	2018-04-05 21:21:08 -07:00
powercap	…
pps	…
ps3	…
ptp	…
pwm	pwm: Changes for v4.17-rc1	2018-04-13 15:46:21 -07:00
rapidio	rapidio: use a reference count for struct mport_dma_req	2018-04-11 10:28:37 -07:00
ras	…
regulator	…
remoteproc	remoteproc: fix null pointer dereference on glink only platforms	2018-04-05 22:53:16 -07:00
reset	…
rpmsg	…
rtc	RTC for 4.17	2018-04-10 10:22:27 -07:00
s390	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux	2018-04-13 09:43:20 -07:00
sbus	…
scsi	SCSI fixes on 20180415	2018-04-15 17:24:12 -07:00
sfi	…
sh	…
siox	…
slimbus	…
sn	…
soc	The large diff this time around is from the addition of a new clk driver	2018-04-13 15:51:06 -07:00
soundwire	…
spi	spi: SPI updates for v4.17	2018-04-03 12:06:21 -07:00
spmi	…
ssb	…
staging	page cache: use xa_lock	2018-04-11 10:28:39 -07:00
target	for-4.17/block-20180402	2018-04-05 14:27:02 -07:00
tc	…
tee	…
thermal	Merge branches 'thermal-core' and 'thermal-soc' into next	2018-04-13 14:11:53 +08:00
thunderbolt	…
tty	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux	2018-04-09 09:04:10 -07:00
uio	…
usb	Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2018-04-07 11:11:41 -07:00
uwb	…
vfio	VFIO updates for v4.17-rc1	2018-04-06 19:44:27 -07:00
vhost	vhost: return bool from *_access_ok() functions	2018-04-11 10:54:06 -04:00
video	fbdev changes for v4.17:	2018-04-10 10:20:00 -07:00
virt	…
virtio	virtio: feature	2018-04-11 18:58:27 -07:00
visorbus	…
vlynq	…
vme	…
w1	…
watchdog	linux-watchdog 4.17-rc1 merge window tag	2018-04-13 15:43:50 -07:00
xen	xen: fixes for 4.17-rc1	2018-04-12 11:04:35 -07:00
zorro	…
Kconfig	…
Makefile	…