Commit 3d14bd48 authored by Herbert Xu's avatar Herbert Xu
Browse files

crypto: algif_aead - Fix minimum RX size check for decryption 



The check for the minimum receive buffer size did not take the
tag size into account during decryption.  Fix this by adding the
required extra length.

Reported-by: default avatar <syzbot+aa11561819dc42ebbc7c@syzkaller.appspotmail.com>
Reported-by: default avatarDaniel Pouzzner <douzzer@mega.nu>
Fixes: d887c52d ("crypto: algif_aead - overhaul memory management")
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent d702c340

crypto/algif_aead.c

+1 −1
Original line number Diff line number Diff line
@@ -144,7 +144,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, 
	if (usedpages < outlen) {

		size_t less = outlen - usedpages;



		if (used < less) {

		if (used < less + (ctx->enc ? 0 : as)) {

			err = -EINVAL;

			goto free;

		}