mirror of
https://github.com/torvalds/linux
synced 2024-09-06 09:51:23 +00:00
crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
During NVMeTCP Authentication a controller can trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a correctly sized, but zeroed Diffie Hellamn value. mpi_cmp_ui() was detecting this if the second parameter was 0, but 1 is passed from dh_is_pubkey_valid(). This causes the null pointer u->d to be dereferenced towards the end of mpi_cmp_ui() Signed-off-by: Mark O'Donovan <shiftee@posteo.net> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
parent
2a598d0b28
commit
9e47a758b7
|
@ -25,8 +25,12 @@ int mpi_cmp_ui(MPI u, unsigned long v)
|
|||
mpi_limb_t limb = v;
|
||||
|
||||
mpi_normalize(u);
|
||||
if (!u->nlimbs && !limb)
|
||||
return 0;
|
||||
if (u->nlimbs == 0) {
|
||||
if (v == 0)
|
||||
return 0;
|
||||
else
|
||||
return -1;
|
||||
}
|
||||
if (u->sign)
|
||||
return -1;
|
||||
if (u->nlimbs > 1)
|
||||
|
|
Loading…
Reference in a new issue