Commit 744e1885 authored by Chengming Zhou's avatar Chengming Zhou Committed by Herbert Xu
Browse files

crypto: scomp - fix req->dst buffer overflow 



The req->dst buffer size should be checked before copying from the
scomp_scratch->dst to avoid req->dst buffer overflow problem.

Fixes: 1ab53a77 ("crypto: acomp - add driver-side scomp interface")
Reported-by: default avatar <syzbot+3eff5e51bf1db122a16e@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/


Signed-off-by: default avatarChengming Zhou <zhouchengming@bytedance.com>
Reviewed-by: default avatarBarry Song <v-songbaohua@oppo.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 44ff4ea1

crypto/scompress.c

+6 −0
Original line number Diff line number Diff line
@@ -117,6 +117,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) 
	struct crypto_scomp *scomp = *tfm_ctx;

	void **ctx = acomp_request_ctx(req);

	struct scomp_scratch *scratch;

	unsigned int dlen;

	int ret;



	if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE)
@@ -128,6 +129,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) 
	if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE)

		req->dlen = SCOMP_SCRATCH_SIZE;



	dlen = req->dlen;



	scratch = raw_cpu_ptr(&scomp_scratch);

	spin_lock(&scratch->lock);
@@ -145,6 +148,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) 
				ret = -ENOMEM;

				goto out;

			}

		} else if (req->dlen > dlen) {

			ret = -ENOSPC;

			goto out;

		}

		scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen,

					 1);