[src/trunk]: src/sys/opencrypto crypto(4): Refuse count>1 for old CIOCNCRYPTM.

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2d0824751c4d
branches:  trunk
changeset: 363442:2d0824751c4d
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sat Mar 12 17:15:04 2022 +0000

description:
crypto(4): Refuse count>1 for old CIOCNCRYPTM.

This hasn't worked since it was written in 2009; if anyone cared
surely they would have fixed it by now!

(Fixing this properly -- and putting a more reasonable upper bound
than the maximum that size_t arithmetic allows -- left as an exercise
or the reader.)

Reported-by: syzbot+798d4a16bc15ae88526e%syzkaller.appspotmail.com@localhost

diffstat:

 sys/opencrypto/ocryptodev.c |  7 +++----
 1 files changed, 3 insertions(+), 4 deletions(-)

diffs (28 lines):

diff -r 08363a561520 -r 2d0824751c4d sys/opencrypto/ocryptodev.c
--- a/sys/opencrypto/ocryptodev.c       Sat Mar 12 17:07:10 2022 +0000
+++ b/sys/opencrypto/ocryptodev.c       Sat Mar 12 17:15:04 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ocryptodev.c,v 1.16 2020/01/27 17:09:17 pgoyette Exp $ */
+/*     $NetBSD: ocryptodev.c,v 1.17 2022/03/12 17:15:04 riastradh Exp $ */
 /*     $FreeBSD: src/sys/opencrypto/cryptodev.c,v 1.4.2.4 2003/06/03 00:09:02 sam Exp $        */
 /*     $OpenBSD: cryptodev.c,v 1.53 2002/07/10 22:21:30 mickey Exp $   */
 
@@ -69,7 +69,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ocryptodev.c,v 1.16 2020/01/27 17:09:17 pgoyette Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ocryptodev.c,v 1.17 2022/03/12 17:15:04 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -167,8 +167,7 @@
                break;
        case OCIOCNCRYPTM:
                omop = (struct ocrypt_mop *)data;
-               if ((omop->count <= 0) ||
-                   (SIZE_MAX/sizeof(struct ocrypt_n_op) <= omop->count)) {
+               if (omop->count <= 0 || omop->count > 1) {
                        error = EINVAL;
                        break;
                }