crypto: lrw - Fix out-of bounds access on counter overflow

BugLink: https://bugs.launchpad.net/bugs/1836802
commit fbe1a850b3b1522e9fc22319ccbbcd2ab05328d2 upstream.

When the LRW block counter overflows, the current implementation returns
128 as the index to the precomputed multiplication table, which has 128
entries. This patch fixes it to return the correct value (127).

Fixes: 64470f1b8510 ("[CRYPTO] lrw: Liskov Rivest Wagner, a tweakable narrow block cipher mode")
Cc: <stable@vger.kernel.org> # 2.6.20+
Reported-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/crypto/lrw.c b/crypto/lrw.c
index 1d813a6d3fecb7a3743ce35a9c5e18fa002cf90f..9c5bf4afe36f1c066484e520f3675fa80e14b5e1 100644 (file)
--- a/crypto/lrw.c
+++ b/crypto/lrw.c
@@ -139,7 +139,12 @@ static inline int get_index128(be128 *block)
                return x + ffz(val);
        }
 
-       return x;
+       /*
+        * If we get here, then x == 128 and we are incrementing the counter
+        * from all ones to all zeros. This means we must return index 127, i.e.
+        * the one corresponding to key2*{ 1,...,1 }.
+        */
+       return 127;
 }
 
 static int post_crypt(struct skcipher_request *req)