lkml.org 
[lkml]   [2016]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 268/346] crypto: skcipher - Fix blkcipher walk OOM crash
    3.16.39-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Herbert Xu <herbert@gondor.apana.org.au>

    commit acdb04d0b36769b3e05990c488dc74d8b7ac8060 upstream.

    When we need to allocate a temporary blkcipher_walk_next and it
    fails, the code is supposed to take the slow path of processing
    the data block by block. However, due to an unrelated change
    we instead end up dereferencing the NULL pointer.

    This patch fixes it by moving the unrelated bsize setting out
    of the way so that we enter the slow path as inteded.

    Fixes: 7607bd8ff03b ("[CRYPTO] blkcipher: Added blkcipher_walk_virt_block")
    Reported-by: xiakaixu <xiakaixu@huawei.com>
    Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    crypto/blkcipher.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/crypto/blkcipher.c
    +++ b/crypto/blkcipher.c
    @@ -233,6 +233,8 @@ static int blkcipher_walk_next(struct bl
    return blkcipher_walk_done(desc, walk, -EINVAL);
    }

    + bsize = min(walk->walk_blocksize, n);
    +
    walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY |
    BLKCIPHER_WALK_DIFF);
    if (!scatterwalk_aligned(&walk->in, walk->alignmask) ||
    @@ -245,7 +247,6 @@ static int blkcipher_walk_next(struct bl
    }
    }

    - bsize = min(walk->walk_blocksize, n);
    n = scatterwalk_clamp(&walk->in, n);
    n = scatterwalk_clamp(&walk->out, n);

    \
     
     \ /
      Last update: 2016-11-14 04:35    [W:2.393 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site