Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[CRYPTO] api: Fix scatterwalk_sg_chain

Browse source 
When I backed out of using the generic sg chaining (as it isn't currently
portable) and introduced scatterwalk_sg_chain/scatterwalk_sg_next I left
out the sg_is_last check in the latter.  This causes it to potentially
dereference beyond the end of the sg array.

As most uses of scatterwalk_sg_next are bound by an overall length, this
only affected the chaining code in authenc and eseqiv. Thanks to Patrick
McHardy for identifying this problem.

This patch also clears the "last" bit on the head of the chained list as
it's no longer last.  This also went missing in scatterwalk_sg_chain and
is present in sg_chain.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Herbert Xu 2008-04-29 21:53:52 +08:00
parent 161613293f
commit 8ec970d856
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
include/crypto/scatterwalk.h
View file

@ -57,10 +57,14 @@ static inline void scatterwalk_sg_chain(struct scatterlist *sg1, int num,
struct scatterlist *sg2) struct scatterlist *sg2)
{ {
sg_set_page(&sg1[num - 1], (void *)sg2, 0, 0); sg_set_page(&sg1[num - 1], (void *)sg2, 0, 0);
sg1[num - 1].page_link &= ~0x02;
} }
static inline struct scatterlist *scatterwalk_sg_next(struct scatterlist *sg) static inline struct scatterlist *scatterwalk_sg_next(struct scatterlist *sg)
{ {
if (sg_is_last(sg))
return NULL;
return (++sg)->length ? sg : (void *)sg_page(sg); return (++sg)->length ? sg : (void *)sg_page(sg);
} }