Messages in this thread Patch in this message | | | From | Hangyu Hua <> | Subject | [PATCH] net: tls: Fix possible NULL-pointer dereference in tls_decrypt_device() and tls_decrypt_sw() | Date | Mon, 23 Oct 2023 16:06:11 +0800 |
| |
tls_rx_one_record can be called in tls_sw_splice_read and tls_sw_read_sock with msg being NULL. This may lead to null pointer dereferences in tls_decrypt_device and tls_decrypt_sw.
Fix this by adding a check.
Fixes: dd47ed3620e6 ("tls: rx: factor SW handling out of tls_rx_one_record()") Signed-off-by: Hangyu Hua <hbh25y@gmail.com> --- net/tls/tls_sw.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index e9d1e83a859d..411bf148f707 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -1612,7 +1612,11 @@ tls_decrypt_sw(struct sock *sk, struct tls_context *tls_ctx, struct strp_msg *rxm; int pad, err; - err = tls_decrypt_sg(sk, &msg->msg_iter, NULL, darg); + if (msg == NULL) + err = tls_decrypt_sg(sk, NULL, NULL, darg); + else + err = tls_decrypt_sg(sk, &msg->msg_iter, NULL, darg); + if (err < 0) { if (err == -EBADMSG) TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSDECRYPTERROR); @@ -1686,7 +1690,8 @@ tls_decrypt_device(struct sock *sk, struct msghdr *msg, off = rxm->offset + prot->prepend_size; len = rxm->full_len - prot->overhead_size; - err = skb_copy_datagram_msg(darg->skb, off, msg, len); + if (msg != NULL) + err = skb_copy_datagram_msg(darg->skb, off, msg, len); if (err) return err; } -- 2.34.1
| |