From ce28904c93b48681e77faadbe8486fc6b0930f1a Mon Sep 17 00:00:00 2001 From: pjd Date: Thu, 6 Aug 2015 17:13:34 +0000 Subject: [PATCH] After crypto_dispatch() bio might be already delivered and destroyed, so we cannot access it anymore. Setting an error later lead to memory corruption. Assert that crypto_dispatch() was successful. It can fail only if we pass a bogus crypto request, which is a bug in the program, not a runtime condition. PR: 199705 Submitted by: luke.tw Reviewed by: emaste MFC after: 3 days --- sys/geom/eli/g_eli_integrity.c | 11 ++++------- sys/geom/eli/g_eli_privacy.c | 11 ++++------- 2 files changed, 8 insertions(+), 14 deletions(-) diff --git a/sys/geom/eli/g_eli_integrity.c b/sys/geom/eli/g_eli_integrity.c index f7bf1fdad713..f68800197eda 100644 --- a/sys/geom/eli/g_eli_integrity.c +++ b/sys/geom/eli/g_eli_integrity.c @@ -408,8 +408,8 @@ g_eli_auth_run(struct g_eli_worker *wr, struct bio *bp) struct cryptodesc *crde, *crda; u_int i, lsec, nsec, data_secsize, decr_secsize, encr_secsize; off_t dstoff; - int err, error; u_char *p, *data, *auth, *authkey, *plaindata; + int error; G_ELI_LOGREQ(3, bp, "%s", __func__); @@ -451,7 +451,6 @@ g_eli_auth_run(struct g_eli_worker *wr, struct bio *bp) bp->bio_inbed = 0; bp->bio_children = nsec; - error = 0; for (i = 1; i <= nsec; i++, dstoff += encr_secsize) { crp = (struct cryptop *)p; p += sizeof(*crp); crde = (struct cryptodesc *)p; p += sizeof(*crde); @@ -519,10 +518,8 @@ g_eli_auth_run(struct g_eli_worker *wr, struct bio *bp) crda->crd_klen = G_ELI_AUTH_SECKEYLEN * 8; crp->crp_etype = 0; - err = crypto_dispatch(crp); - if (err != 0 && error == 0) - error = err; + error = crypto_dispatch(crp); + KASSERT(error == 0, ("crypto_dispatch() failed (error=%d)", + error)); } - if (bp->bio_error == 0) - bp->bio_error = error; } diff --git a/sys/geom/eli/g_eli_privacy.c b/sys/geom/eli/g_eli_privacy.c index a60efe8f1445..d636e1fb0ba0 100644 --- a/sys/geom/eli/g_eli_privacy.c +++ b/sys/geom/eli/g_eli_privacy.c @@ -230,10 +230,10 @@ g_eli_crypto_run(struct g_eli_worker *wr, struct bio *bp) struct cryptop *crp; struct cryptodesc *crd; u_int i, nsec, secsize; - int err, error; off_t dstoff; size_t size; u_char *p, *data; + int error; G_ELI_LOGREQ(3, bp, "%s", __func__); @@ -271,7 +271,6 @@ g_eli_crypto_run(struct g_eli_worker *wr, struct bio *bp) bcopy(bp->bio_data, data, bp->bio_length); } - error = 0; for (i = 0, dstoff = bp->bio_offset; i < nsec; i++, dstoff += secsize) { crp = (struct cryptop *)p; p += sizeof(*crp); crd = (struct cryptodesc *)p; p += sizeof(*crd); @@ -308,10 +307,8 @@ g_eli_crypto_run(struct g_eli_worker *wr, struct bio *bp) crd->crd_next = NULL; crp->crp_etype = 0; - err = crypto_dispatch(crp); - if (error == 0) - error = err; + error = crypto_dispatch(crp); + KASSERT(error == 0, ("crypto_dispatch() failed (error=%d)", + error)); } - if (bp->bio_error == 0) - bp->bio_error = error; }