Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:
 "This fixes a NULL pointer dereference on allocation failure in caam,
  as well as a regression in the ctr mode on s390 that was added with
  the recent concurrency fixes"

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: s390 - fix aes,des ctr mode concurrency finding.
  crypto: caam - add allocation failure handling in SPRINTFCAT macro

3 files changed, 13 insertions, 3 deletions

diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
index cf3c0089bef2..23223cd63e54 100644
--- a/arch/s390/crypto/aes_s390.c
+++ b/arch/s390/crypto/aes_s390.c
@@ -820,6 +820,9 @@ static int ctr_aes_crypt(struct blkcipher_desc *desc, long func,
                 else
                         memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
                 spin_unlock(&ctrblk_lock);
+        } else {
+                if (!nbytes)
+                        memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
         }
         /*
          * final block may be < AES_BLOCK_SIZE, copy only nbytes
diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c
index 0a5aac8a9412..7acb77f7ef1a 100644
--- a/arch/s390/crypto/des_s390.c
+++ b/arch/s390/crypto/des_s390.c
@@ -429,6 +429,9 @@ static int ctr_desall_crypt(struct blkcipher_desc *desc, long func,
                 else
                         memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
                 spin_unlock(&ctrblk_lock);
+        } else {
+                if (!nbytes)
+                        memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
         }
         /* final block may be < DES_BLOCK_SIZE, copy only nbytes */
         if (nbytes) {
diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
index 9f25f5296029..0eabd81e1a90 100644
--- a/drivers/crypto/caam/error.c
+++ b/drivers/crypto/caam/error.c
@@ -16,9 +16,13 @@
         char *tmp;                                              \
                                                                 \
         tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC);  \
-        sprintf(tmp, format, param);                            \
-        strcat(str, tmp);                                       \
-        kfree(tmp);                                             \
+        if (likely(tmp)) {                                      \
+                sprintf(tmp, format, param);                    \
+                strcat(str, tmp);                               \
+                kfree(tmp);                                     \
+        } else {                                                \
+                strcat(str, "kmalloc failure in SPRINTFCAT");   \
+        }                                                       \
 }
 
 static void report_jump_idx(u32 status, char *outstr)