diff options
author | Dave Watson <davejwatson@fb.com> | 2018-01-19 15:30:13 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2018-01-22 16:25:21 -0500 |
commit | 7a8c4dd9be91a7e8f8f0e0419a560663adc694a3 (patch) | |
tree | 99ba58543d67842199c468baff1cac8d272e0c14 /net | |
parent | 52acf06451930eb4cefabd5ecea56e2d46c32f76 (diff) |
tls: Correct length of scatterlist in tls_sw_sendpage
The scatterlist is reused by both sendmsg and sendfile.
If a sendmsg of smaller number of pages is followed by a sendfile
of larger number of pages, the scatterlist may be too short, resulting
in a crash in gcm_encrypt.
Add sg_unmark_end to make the list the correct length.
tls_sw_sendmsg already calls sg_unmark_end correctly when it allocates
memory in alloc_sg, or in zerocopy_from_iter.
Signed-off-by: Dave Watson <davejwatson@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/tls/tls_sw.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 61f394d369bf..0a9b72fbd761 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c | |||
@@ -577,6 +577,8 @@ alloc_payload: | |||
577 | get_page(page); | 577 | get_page(page); |
578 | sg = ctx->sg_plaintext_data + ctx->sg_plaintext_num_elem; | 578 | sg = ctx->sg_plaintext_data + ctx->sg_plaintext_num_elem; |
579 | sg_set_page(sg, page, copy, offset); | 579 | sg_set_page(sg, page, copy, offset); |
580 | sg_unmark_end(sg); | ||
581 | |||
580 | ctx->sg_plaintext_num_elem++; | 582 | ctx->sg_plaintext_num_elem++; |
581 | 583 | ||
582 | sk_mem_charge(sk, copy); | 584 | sk_mem_charge(sk, copy); |