Commit acdb04d0 authored by Herbert Xu's avatar Herbert Xu

crypto: skcipher - Fix blkcipher walk OOM crash

When we need to allocate a temporary blkcipher_walk_next and it
fails, the code is supposed to take the slow path of processing
the data block by block.  However, due to an unrelated change
we instead end up dereferencing the NULL pointer.

This patch fixes it by moving the unrelated bsize setting out
of the way so that we enter the slow path as inteded.

Fixes: 7607bd8f ("[CRYPTO] blkcipher: Added blkcipher_walk_virt_block")
Cc: stable@vger.kernel.org
Reported-by: default avatarxiakaixu <xiakaixu@huawei.com>
Reported-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Tested-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
parent 53a5d5dd
...@@ -233,6 +233,8 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc, ...@@ -233,6 +233,8 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
return blkcipher_walk_done(desc, walk, -EINVAL); return blkcipher_walk_done(desc, walk, -EINVAL);
} }
bsize = min(walk->walk_blocksize, n);
walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY | walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY |
BLKCIPHER_WALK_DIFF); BLKCIPHER_WALK_DIFF);
if (!scatterwalk_aligned(&walk->in, walk->alignmask) || if (!scatterwalk_aligned(&walk->in, walk->alignmask) ||
...@@ -245,7 +247,6 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc, ...@@ -245,7 +247,6 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
} }
} }
bsize = min(walk->walk_blocksize, n);
n = scatterwalk_clamp(&walk->in, n); n = scatterwalk_clamp(&walk->in, n);
n = scatterwalk_clamp(&walk->out, n); n = scatterwalk_clamp(&walk->out, n);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment