diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2016-01-19 21:23:57 +0800 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2016-01-20 21:15:45 +0800 |
| commit | 202736d99b7f29279db9da61587f11a08a04a9c6 (patch) | |
| tree | 7ec8d1d32fc795eb30a473580d861398454c3a26 /crypto | |
| parent | fd7f6727102a1ccf6b4c1dfcc631f9b546526b26 (diff) | |
| download | op-kernel-dev-202736d99b7f29279db9da61587f11a08a04a9c6.zip op-kernel-dev-202736d99b7f29279db9da61587f11a08a04a9c6.tar.gz | |
crypto: algif_skcipher - sendmsg SG marking is off by one
We mark the end of the SG list in sendmsg and sendpage and unmark
it on the next send call. Unfortunately the unmarking in sendmsg
is off-by-one, leading to an SG list that is too short.
Fixes: 0f477b655a52 ("crypto: algif - Mark sgl end at the end of data")
Cc: stable@vger.kernel.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/algif_skcipher.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c index df86fb4..a81c10f 100644 --- a/crypto/algif_skcipher.c +++ b/crypto/algif_skcipher.c @@ -392,7 +392,8 @@ static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg, sgl = list_entry(ctx->tsgl.prev, struct skcipher_sg_list, list); sg = sgl->sg; - sg_unmark_end(sg + sgl->cur); + if (sgl->cur) + sg_unmark_end(sg + sgl->cur - 1); do { i = sgl->cur; plen = min_t(size_t, len, PAGE_SIZE); |
