Patchwork crypto: AF_ALG - update correct dst SGL entry

login
register
mail settings
Submitter Stephan Mueller
Date Aug. 30, 2017, 7:17 a.m.
Message ID <2484753.VGNM65Hb0R@positron.chronox.de>
Download mbox | patch
Permalink /patch/9928789/
State Accepted
Delegated to: Herbert Xu
Headers show

Comments

Stephan Mueller - Aug. 30, 2017, 7:17 a.m.
When two adjacent TX SGL are processed and parts of both TX SGLs
are pulled into the per-request TX SGL, the wrong per-request
TX SGL entries were updated.

This fixes a NULL pointer dereference when a cipher implementation walks
the TX SGL where some of the SGL entries were NULL.

Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
 crypto/af_alg.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
Herbert Xu - Sept. 20, 2017, 8:34 a.m.
On Wed, Aug 30, 2017 at 09:17:39AM +0200, Stephan Müller wrote:
> When two adjacent TX SGL are processed and parts of both TX SGLs
> are pulled into the per-request TX SGL, the wrong per-request
> TX SGL entries were updated.
> 
> This fixes a NULL pointer dereference when a cipher implementation walks
> the TX SGL where some of the SGL entries were NULL.
> 
> Signed-off-by: Stephan Mueller <smueller@chronox.de>

Oops, looks like you already sent me this fix.  It should have
this fixes header:

Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory...")

Cheers,
Herbert Xu - Sept. 21, 2017, 8:07 a.m.
On Wed, Aug 30, 2017 at 09:17:39AM +0200, Stephan Müller wrote:
> When two adjacent TX SGL are processed and parts of both TX SGLs
> are pulled into the per-request TX SGL, the wrong per-request
> TX SGL entries were updated.
> 
> This fixes a NULL pointer dereference when a cipher implementation walks
> the TX SGL where some of the SGL entries were NULL.
> 
> Signed-off-by: Stephan Mueller <smueller@chronox.de>

Patch applied.  Thanks.

Patch

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index ffa9f4ccd9b4..337cf382718e 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -619,14 +619,14 @@  void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
 	struct af_alg_ctx *ctx = ask->private;
 	struct af_alg_tsgl *sgl;
 	struct scatterlist *sg;
-	unsigned int i, j;
+	unsigned int i, j = 0;
 
 	while (!list_empty(&ctx->tsgl_list)) {
 		sgl = list_first_entry(&ctx->tsgl_list, struct af_alg_tsgl,
 				       list);
 		sg = sgl->sg;
 
-		for (i = 0, j = 0; i < sgl->cur; i++) {
+		for (i = 0; i < sgl->cur; i++) {
 			size_t plen = min_t(size_t, used, sg[i].length);
 			struct page *page = sg_page(sg + i);