diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2018-06-24 06:31:54 +0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2018-06-24 06:31:54 +0800 |
| commit | 2dd3f7c904cce0d4b0e4684a62ce8b9024f8efda (patch) | |
| tree | cc0f95fe853e35bbd06a18c423f63e8baa2aa171 /drivers/crypto/chelsio/chtls | |
| parent | b13fbe77132575f621ce992a9be47d067a606308 (diff) | |
| parent | 837bf7cc3b7504385ae0e829c72e470dfc27cf6c (diff) | |
| download | op-kernel-dev-2dd3f7c904cce0d4b0e4684a62ce8b9024f8efda.zip op-kernel-dev-2dd3f7c904cce0d4b0e4684a62ce8b9024f8efda.tar.gz | |
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
- Fix use after free in chtls
- Fix RBP breakage in sha3
- Fix use after free in hwrng_unregister
- Fix overread in morus640
- Move sleep out of kernel_neon in arm64/aes-blk
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
hwrng: core - Always drop the RNG in hwrng_unregister()
crypto: morus640 - Fix out-of-bounds access
crypto: don't optimize keccakf()
crypto: arm64/aes-blk - fix and move skcipher_walk_done out of kernel_neon_begin, _end
crypto: chtls - use after free in chtls_pt_recvmsg()
Diffstat (limited to 'drivers/crypto/chelsio/chtls')
| -rw-r--r-- | drivers/crypto/chelsio/chtls/chtls_io.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c index 00c7aab..afebbd8 100644 --- a/drivers/crypto/chelsio/chtls/chtls_io.c +++ b/drivers/crypto/chelsio/chtls/chtls_io.c @@ -1548,15 +1548,14 @@ skip_copy: tp->urg_data = 0; if ((avail + offset) >= skb->len) { - if (likely(skb)) - chtls_free_skb(sk, skb); - buffers_freed++; if (ULP_SKB_CB(skb)->flags & ULPCB_FLAG_TLS_HDR) { tp->copied_seq += skb->len; hws->rcvpld = skb->hdr_len; } else { tp->copied_seq += hws->rcvpld; } + chtls_free_skb(sk, skb); + buffers_freed++; hws->copied_seq = 0; if (copied >= target && !skb_peek(&sk->sk_receive_queue)) |
