crypto: chacha20poly1305 - validate poly1305 template argument

chachapoly_create() still accepts the compatibility poly1305 parameter
in the template name, but it assumes the second template argument is
always present and immediately passes it to strcmp().

When the argument is missing, crypto_attr_alg_name() returns an error
pointer. Check for that before comparing the name so malformed template
instantiations fail with an error instead of dereferencing the error
pointer in strcmp().

This matches the surrounding Crypto API template pattern where
crypto_attr_alg_name() results are validated before string-specific use.

Fixes: a298765e28ad ("crypto: chacha20poly1305 - Use lib/crypto poly1305")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Co-developed-by: Luxing Yin <tr0jan@lzu.edu.cn>
Signed-off-by: Luxing Yin <tr0jan@lzu.edu.cn>
Signed-off-by: Xiaonan Zhao <ngochuongbui67@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c
index b4b5a7198d841297c31444dded63954d547d9aa7..27df9e1eb0580a886fac3474cb1bf87fea73639c 100644 (file)
--- a/crypto/chacha20poly1305.c
+++ b/crypto/chacha20poly1305.c
@@ -375,6 +375,7 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb,
        struct aead_instance *inst;
        struct chachapoly_instance_ctx *ctx;
        struct skcipher_alg_common *chacha;
+       const char *poly_name;
        int err;
 
        if (ivsize > CHACHAPOLY_IV_SIZE)
@@ -396,9 +397,15 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb,
                goto err_free_inst;
        chacha = crypto_spawn_skcipher_alg_common(&ctx->chacha);
 
+       poly_name = crypto_attr_alg_name(tb[2]);
+       if (IS_ERR(poly_name)) {
+               err = PTR_ERR(poly_name);
+               goto err_free_inst;
+       }
+
        err = -EINVAL;
-       if (strcmp(crypto_attr_alg_name(tb[2]), "poly1305") &&
-           strcmp(crypto_attr_alg_name(tb[2]), "poly1305-generic"))
+       if (strcmp(poly_name, "poly1305") &&
+           strcmp(poly_name, "poly1305-generic"))
                goto err_free_inst;
        /* Need 16-byte IV size, including Initial Block Counter value */
        if (chacha->ivsize != CHACHA_IV_SIZE)