aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2017-10-09 11:30:02 -0400
committerHerbert Xu <herbert@gondor.apana.org.au>2017-10-10 12:34:07 -0400
commitb61907bb42409adf9b3120f741af7c57dd7e3db2 (patch)
tree5e2e631bddf0f13336e2c52ac93cbce361bfcbd7
parent0cabf2af6f5ac3c88cb106c4e06087a5a39b8e1e (diff)
crypto: shash - Fix zero-length shash ahash digest crash
The shash ahash digest adaptor function may crash if given a zero-length input together with a null SG list. This is because it tries to read the SG list before looking at the length. This patch fixes it by checking the length first. Cc: <stable@vger.kernel.org> Reported-by: Stephan Müller<smueller@chronox.de> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Tested-by: Stephan Müller <smueller@chronox.de>
-rw-r--r--crypto/shash.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/crypto/shash.c b/crypto/shash.c
index 8fcecc66741d..325a14da5827 100644
--- a/crypto/shash.c
+++ b/crypto/shash.c
@@ -275,12 +275,14 @@ static int shash_async_finup(struct ahash_request *req)
275 275
276int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc) 276int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc)
277{ 277{
278 struct scatterlist *sg = req->src;
279 unsigned int offset = sg->offset;
280 unsigned int nbytes = req->nbytes; 278 unsigned int nbytes = req->nbytes;
279 struct scatterlist *sg;
280 unsigned int offset;
281 int err; 281 int err;
282 282
283 if (nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset)) { 283 if (nbytes &&
284 (sg = req->src, offset = sg->offset,
285 nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset))) {
284 void *data; 286 void *data;
285 287
286 data = kmap_atomic(sg_page(sg)); 288 data = kmap_atomic(sg_page(sg));