diff options
| author | Tom Lendacky <thomas.lendacky@amd.com> | 2016-04-13 10:52:25 -0500 |
|---|---|---|
| committer | Sasha Levin <sasha.levin@oracle.com> | 2016-05-08 08:09:02 -0400 |
| commit | 3fa5e41c8667e3856ba3191b7156157b8f8aaf1c (patch) | |
| tree | bc945e63fabbf61c06169dff6b872485e2e00cb2 /drivers/crypto | |
| parent | f6a93797957220ead95f575047f43e1d4d085205 (diff) | |
crypto: ccp - Prevent information leakage on export
[ Upstream commit f709b45ec461b548c41a00044dba1f1b572783bf ]
Prevent information from leaking to userspace by doing a memset to 0 of
the export state structure before setting the structure values and copying
it. This prevents un-initialized padding areas from being copied into the
export area.
Cc: <stable@vger.kernel.org> # 3.14.x-
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Diffstat (limited to 'drivers/crypto')
| -rw-r--r-- | drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 3 | ||||
| -rw-r--r-- | drivers/crypto/ccp/ccp-crypto-sha.c | 3 |
2 files changed, 6 insertions, 0 deletions
diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c index 0a4973b47c99..a2ca3c757712 100644 --- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c +++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c @@ -207,6 +207,9 @@ static int ccp_aes_cmac_export(struct ahash_request *req, void *out) struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req); struct ccp_aes_cmac_exp_ctx state; + /* Don't let anything leak to 'out' */ + memset(&state, 0, sizeof(state)); + state.null_msg = rctx->null_msg; memcpy(state.iv, rctx->iv, sizeof(state.iv)); state.buf_count = rctx->buf_count; diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c index 9711b6d29162..895c0d1316e5 100644 --- a/drivers/crypto/ccp/ccp-crypto-sha.c +++ b/drivers/crypto/ccp/ccp-crypto-sha.c @@ -199,6 +199,9 @@ static int ccp_sha_export(struct ahash_request *req, void *out) struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req); struct ccp_sha_exp_ctx state; + /* Don't let anything leak to 'out' */ + memset(&state, 0, sizeof(state)); + state.type = rctx->type; state.msg_bits = rctx->msg_bits; state.first = rctx->first; |