net/tls: handle errors from padding_length()
authorJakub Kicinski <jakub.kicinski@netronome.com>
Thu, 9 May 2019 23:14:07 +0000 (16:14 -0700)
committerDavid S. Miller <davem@davemloft.net>
Thu, 9 May 2019 23:37:39 +0000 (16:37 -0700)
commitb53f4976fb1f738573b5b76e21d3c2652fffb46b
tree7b72ad4d3694231a1a1cba89873957367474eb22
parent88c80bee883e7687d2672f84fd6d0fa1cee3d348
net/tls: handle errors from padding_length()

At the time padding_length() is called the record header
is still part of the message.  If malicious TLS 1.3 peer
sends an all-zero record padding_length() will stop at
the record header, and return full length of the data
including the tail_size.

Subsequent subtraction of prot->overhead_size from rxm->full_len
will cause rxm->full_len to turn negative.  skb accessors,
however, will always catch resulting out-of-bounds operation,
so in practice this fix comes down to returning the correct
error code.  It also fixes a set but not used warning.

This code was added by commit 130b392c6cd6 ("net: tls: Add tls 1.3 support").

CC: Dave Watson <davejwatson@fb.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tls/tls_sw.c