When authencesn is used together with digest_null a crash will
occur on the decrypt path.  This is because normally we perform
a special setup to preserve the ESN, but this is skipped if there
is no authentication.  However, on the post-authentication path
it always expects the preservation to be in place, thus causing
a crash when digest_null is used.

This patch fixes this by also skipping the post-processing when
there is no authentication.

Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD...")
Cc: <sta...@vger.kernel.org>
Reported-by: Jan Tluka <jtl...@redhat.com>
Signed-off-by: Herbert Xu <herb...@gondor.apana.org.au>

diff --git a/crypto/authencesn.c b/crypto/authencesn.c
index 6f8f6b8..0cf5fef 100644
--- a/crypto/authencesn.c
+++ b/crypto/authencesn.c
@@ -248,6 +248,9 @@ static int crypto_authenc_esn_decrypt_tail(struct 
aead_request *req,
        u8 *ihash = ohash + crypto_ahash_digestsize(auth);
        u32 tmp[2];
+       if (!authsize)
+               goto decrypt;
        /* Move high-order bits of sequence number back. */
        scatterwalk_map_and_copy(tmp, dst, 4, 4, 0);
        scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 0);
@@ -256,6 +259,8 @@ static int crypto_authenc_esn_decrypt_tail(struct 
aead_request *req,
        if (crypto_memneq(ihash, ohash, authsize))
                return -EBADMSG;
        sg_init_table(areq_ctx->dst, 2);
        dst = scatterwalk_ffwd(areq_ctx->dst, dst, assoclen);
Email: Herbert Xu <herb...@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Reply via email to