Jakub Kicinski b53f4976fb net/tls: handle errors from padding_length() ... At the time padding_length() is called the record header is still part of the message. If malicious TLS 1.3 peer sends an all-zero record padding_length() will stop at the record header, and return full length of the data including the tail_size. Subsequent subtraction of prot->overhead_size from rxm->full_len will cause rxm->full_len to turn negative. skb accessors, however, will always catch resulting out-of-bounds operation, so in practice this fix comes down to returning the correct error code. It also fixes a set but not used warning. This code was added by commit 130b392c6c ("net: tls: Add tls 1.3 support"). CC: Dave Watson <davejwatson@fb.com> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-05-09 16:37:39 -07:00
..
Kconfig
Makefile
tls_device_fallback.c	net/tls: avoid NULL pointer deref on nskb->sk in fallback	2019-05-01 11:37:56 -04:00
tls_device.c	net/tls: remove set but not used variables	2019-05-09 16:37:39 -07:00
tls_main.c
tls_sw.c	net/tls: handle errors from padding_length()	2019-05-09 16:37:39 -07:00