9e47a758b7
During NVMeTCP Authentication a controller can trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a correctly sized, but zeroed Diffie Hellamn value. mpi_cmp_ui() was detecting this if the second parameter was 0, but 1 is passed from dh_is_pubkey_valid(). This causes the null pointer u->d to be dereferenced towards the end of mpi_cmp_ui() Signed-off-by: Mark O'Donovan <shiftee@posteo.net> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
||
|---|---|---|
| .. | ||
| mpi | ||
| aes.c | ||
| aesgcm.c | ||
| arc4.c | ||
| blake2s-generic.c | ||
| blake2s-selftest.c | ||
| blake2s.c | ||
| chacha20poly1305-selftest.c | ||
| chacha20poly1305.c | ||
| chacha.c | ||
| curve25519-fiat32.c | ||
| curve25519-generic.c | ||
| curve25519-hacl64.c | ||
| curve25519-selftest.c | ||
| curve25519.c | ||
| des.c | ||
| gf128mul.c | ||
| Kconfig | ||
| libchacha.c | ||
| Makefile | ||
| memneq.c | ||
| poly1305-donna32.c | ||
| poly1305-donna64.c | ||
| poly1305.c | ||
| sha1.c | ||
| sha256.c | ||
| utils.c | ||