Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

crypto: af-alg - fix NULL pointer dereference in scatterwalk

The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)
when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL
exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent
sendmsg() allocates a new SGL and chains it, but fails to clear the end
marker on the previous SGL's last data entry.

This causes the crypto scatterwalk to hit a premature end, returning NULL
on sg_next() and leading to a kernel panic during dereference.

Fix this by explicitly unmarking the end of the previous SGL when
performing sg_chain() in af_alg_alloc_tsgl().

Fixes: 8ff590903d5f ("crypto: algif_skcipher - User-space interface for skcipher operations")
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

authored by

Norbert Szetei and committed by
Herbert Xu
62397b49 6d89f743

+3 -1
+3 -1
crypto/af_alg.c
··· 623 623 sg_init_table(sgl->sg, MAX_SGL_ENTS + 1); 624 624 sgl->cur = 0; 625 625 626 - if (sg) 626 + if (sg) { 627 + sg_unmark_end(sg + MAX_SGL_ENTS - 1); 627 628 sg_chain(sg, MAX_SGL_ENTS + 1, sgl->sg); 629 + } 628 630 629 631 list_add_tail(&sgl->list, &ctx->tsgl_list); 630 632 }