Pull nfsd fix from Chuck Lever: - Fix a crash when using NFS with krb5p * tag 'nfsd-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: SUNRPC: Fix a crash in gss_krb5_checksum()
Unified · Split
| @@ -353,7 +353,9 @@ gss_krb5_checksum(struct crypto_ahash *tfm, char *header, int hdrlen, · 352 unmodified lines | |||
| 353 | err = crypto_ahash_final(req); | 353 | err = crypto_ahash_final(req); |
| 354 | if (err) | 354 | if (err) |
| 355 | goto out_free_ahash; | 355 | goto out_free_ahash; |
| 356 | memcpy(cksumout->data, checksumdata, cksumout->len); | 356 | |
| 357 | memcpy(cksumout->data, checksumdata, | ||
| 358 | min_t(int, cksumout->len, crypto_ahash_digestsize(tfm))); | ||
| 357 | 359 | ||
| 358 | out_free_ahash: | 360 | out_free_ahash: |
| 359 | ahash_request_free(req); | 361 | ahash_request_free(req); |
| @@ -809,8 +811,7 @@ gss_krb5_aes_encrypt(struct krb5_ctx *kctx, u32 offset, · 449 unmodified lines | |||
| 809 | buf->tail[0].iov_len += GSS_KRB5_TOK_HDR_LEN; | 811 | buf->tail[0].iov_len += GSS_KRB5_TOK_HDR_LEN; |
| 810 | buf->len += GSS_KRB5_TOK_HDR_LEN; | 812 | buf->len += GSS_KRB5_TOK_HDR_LEN; |
| 811 | 813 | ||
| 812 | /* Do the HMAC */ | 814 | hmac.len = kctx->gk5e->cksumlength; |
| 813 | hmac.len = GSS_KRB5_MAX_CKSUM_LEN; | ||
| 814 | hmac.data = buf->tail[0].iov_base + buf->tail[0].iov_len; | 815 | hmac.data = buf->tail[0].iov_base + buf->tail[0].iov_len; |
| 815 | 816 | ||
| 816 | /* | 817 | /* |
| @@ -873,8 +874,7 @@ gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len, · 56 unmodified lines | |||
| 873 | if (ret) | 874 | if (ret) |
| 874 | goto out_err; | 875 | goto out_err; |
| 875 | 876 | ||
| 876 | /* Calculate our hmac over the plaintext data */ | 877 | our_hmac_obj.len = kctx->gk5e->cksumlength; |
| 877 | our_hmac_obj.len = sizeof(our_hmac); | ||
| 878 | our_hmac_obj.data = our_hmac; | 878 | our_hmac_obj.data = our_hmac; |
| 879 | ret = gss_krb5_checksum(ahash, NULL, 0, &subbuf, 0, &our_hmac_obj); | 879 | ret = gss_krb5_checksum(ahash, NULL, 0, &subbuf, 0, &our_hmac_obj); |
| 880 | if (ret) | 880 | if (ret) |