| From acdb04d0b36769b3e05990c488dc74d8b7ac8060 Mon Sep 17 00:00:00 2001 |
| From: Herbert Xu <herbert@gondor.apana.org.au> |
| Date: Tue, 13 Sep 2016 14:43:29 +0800 |
| Subject: crypto: skcipher - Fix blkcipher walk OOM crash |
| |
| From: Herbert Xu <herbert@gondor.apana.org.au> |
| |
| commit acdb04d0b36769b3e05990c488dc74d8b7ac8060 upstream. |
| |
| When we need to allocate a temporary blkcipher_walk_next and it |
| fails, the code is supposed to take the slow path of processing |
| the data block by block. However, due to an unrelated change |
| we instead end up dereferencing the NULL pointer. |
| |
| This patch fixes it by moving the unrelated bsize setting out |
| of the way so that we enter the slow path as inteded. |
| |
| Fixes: 7607bd8ff03b ("[CRYPTO] blkcipher: Added blkcipher_walk_virt_block") |
| Reported-by: xiakaixu <xiakaixu@huawei.com> |
| Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> |
| Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| crypto/blkcipher.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/crypto/blkcipher.c |
| +++ b/crypto/blkcipher.c |
| @@ -234,6 +234,8 @@ static int blkcipher_walk_next(struct bl |
| return blkcipher_walk_done(desc, walk, -EINVAL); |
| } |
| |
| + bsize = min(walk->walk_blocksize, n); |
| + |
| walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY | |
| BLKCIPHER_WALK_DIFF); |
| if (!scatterwalk_aligned(&walk->in, walk->alignmask) || |
| @@ -246,7 +248,6 @@ static int blkcipher_walk_next(struct bl |
| } |
| } |
| |
| - bsize = min(walk->walk_blocksize, n); |
| n = scatterwalk_clamp(&walk->in, n); |
| n = scatterwalk_clamp(&walk->out, n); |
| |