diff options
author | Herbert Xu <herbert@gondor.apana.org.au> | 2017-10-09 11:30:02 -0400 |
---|---|---|
committer | Herbert Xu <herbert@gondor.apana.org.au> | 2017-10-10 12:34:07 -0400 |
commit | b61907bb42409adf9b3120f741af7c57dd7e3db2 (patch) | |
tree | 5e2e631bddf0f13336e2c52ac93cbce361bfcbd7 | |
parent | 0cabf2af6f5ac3c88cb106c4e06087a5a39b8e1e (diff) |
crypto: shash - Fix zero-length shash ahash digest crash
The shash ahash digest adaptor function may crash if given a
zero-length input together with a null SG list. This is because
it tries to read the SG list before looking at the length.
This patch fixes it by checking the length first.
Cc: <stable@vger.kernel.org>
Reported-by: Stephan Müller<smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Stephan Müller <smueller@chronox.de>
-rw-r--r-- | crypto/shash.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/crypto/shash.c b/crypto/shash.c index 8fcecc66741d..325a14da5827 100644 --- a/crypto/shash.c +++ b/crypto/shash.c | |||
@@ -275,12 +275,14 @@ static int shash_async_finup(struct ahash_request *req) | |||
275 | 275 | ||
276 | int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc) | 276 | int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc) |
277 | { | 277 | { |
278 | struct scatterlist *sg = req->src; | ||
279 | unsigned int offset = sg->offset; | ||
280 | unsigned int nbytes = req->nbytes; | 278 | unsigned int nbytes = req->nbytes; |
279 | struct scatterlist *sg; | ||
280 | unsigned int offset; | ||
281 | int err; | 281 | int err; |
282 | 282 | ||
283 | if (nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset)) { | 283 | if (nbytes && |
284 | (sg = req->src, offset = sg->offset, | ||
285 | nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset))) { | ||
284 | void *data; | 286 | void *data; |
285 | 287 | ||
286 | data = kmap_atomic(sg_page(sg)); | 288 | data = kmap_atomic(sg_page(sg)); |