{"push_id":705075781,"size":1,"distinct_size":1,"ref":"refs/heads/lollipop-caf","head":"0e8078fcac6fe39de5671f3ea732cce31dfc10c5","before":"ba0d7d55f794b98fff66673e10f3e4c712e942cb","commits":[{"sha":"0e8078fcac6fe39de5671f3ea732cce31dfc10c5","author":{"email":"cc02df512ad79bcd2ad3264230580f113da4eba6@chronox.de","name":"Stephan Mueller"},"message":"crypto: aesni - fix memory usage in GCM decryption\n\ncommit ccfe8c3f7e52ae83155cb038753f4c75b774ca8a upstream.\n\nThe kernel crypto API logic requires the caller to provide the\nlength of (ciphertext || authentication tag) as cryptlen for the\nAEAD decryption operation. Thus, the cipher implementation must\ncalculate the size of the plaintext output itself and cannot simply use\ncryptlen.\n\nThe RFC4106 GCM decryption operation tries to overwrite cryptlen memory\nin req->dst. As the destination buffer for decryption only needs to hold\nthe plaintext memory but cryptlen references the input buffer holding\n(ciphertext || authentication tag), the assumption of the destination\nbuffer length in RFC4106 GCM operation leads to a too large size. This\npatch simply uses the already calculated plaintext size.\n\nIn addition, this patch fixes the offset calculation of the AAD buffer\npointer: as mentioned before, cryptlen already includes the size of the\ntag. Thus, the tag does not need to be added. With the addition, the AAD\nwill be written beyond the already allocated buffer.\n\nNote, this fixes a kernel crash that can be triggered from user space\nvia AF_ALG(aead) -- simply use the libkcapi test application\nfrom [1] and update it to use rfc4106-gcm-aes.\n\nUsing [1], the changes were tested using CAVS vectors to demonstrate\nthat the crypto operation still delivers the right results.\n\n[1] http://www.chronox.de/libkcapi.html\n\nChange-Id: Icac3473a867844e8de620c5f30f77571e73ded63\nCC: Tadeusz Struk <tadeusz.struk@intel.com>\nSigned-off-by: Stephan Mueller <smueller@chronox.de>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":true,"url":"https://api.github.com/repos/DirtyUnicorns/android_kernel_samsung_hlte/commits/0e8078fcac6fe39de5671f3ea732cce31dfc10c5"}]}