HomeFreeBSD

opencrypto: Handle end-of-cursor conditions in crypto_cursor_segment()

Description

opencrypto: Handle end-of-cursor conditions in crypto_cursor_segment()

Some consumers, e.g., swcr_encdec(), may call crypto_cursor_segment()
after having advanced the cursor to the end of the buffer. In this case
I believe the right behaviour is to return NULL and a length of 0.

When this occurs with a CRYPTO_BUF_VMPAGE buffer, the cc_vmpage pointer
will point past the end of the page pointer array, so
crypto_cursor_segment() ends up dereferencing a random pointer before
the function returns a length of 0. The uio-backed cursor has
a similar problem.

Address this by keeping track of the residual buffer length and
returning immediately once the length is zero.

PR: 271766
Reported by: Andrew "RhodiumToad" Gierth <andrew@tao11.riddles.org.uk>
Reviewed by: jhb
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40428

(cherry picked from commit 718d4a1d5643c2faf409001320c3fd64aae57638)

Details

Provenance
markjAuthored on Jun 12 2023, 4:09 PM
Reviewer
jhb
Differential Revision
D40428: opencrypto: Handle end-of-cursor conditions in crypto_cursor_segment()
Parents
rG232bd8e8d896: vm_phys: Change the return type of vm_phys_unfree_page() to bool
Branches
Unknown
Tags
Unknown