1 files changed, 10 insertions, 6 deletions

diff --git a/crypto/hmac.c b/crypto/hmac.c
index 14c6351e639d..7ff2d6a8c7d0 100644
--- a/crypto/hmac.c
+++ b/crypto/hmac.c
@@ -226,6 +226,7 @@ static struct crypto_instance *hmac_alloc(struct rtattr **tb)
         struct crypto_instance *inst;
         struct crypto_alg *alg;
         int err;
+        int ds;
 
         err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_HASH);
         if (err)
@@ -236,6 +237,13 @@ static struct crypto_instance *hmac_alloc(struct rtattr **tb)
         if (IS_ERR(alg))
                 return ERR_CAST(alg);
 
+        inst = ERR_PTR(-EINVAL);
+        ds = (alg->cra_flags & CRYPTO_ALG_TYPE_MASK) ==
+             CRYPTO_ALG_TYPE_HASH ? alg->cra_hash.digestsize :
+                                    alg->cra_digest.dia_digestsize;
+        if (ds > alg->cra_blocksize)
+                goto out_put_alg;
+
         inst = crypto_alloc_instance("hmac", alg);
         if (IS_ERR(inst))
                 goto out_put_alg;
@@ -246,14 +254,10 @@ static struct crypto_instance *hmac_alloc(struct rtattr **tb)
         inst->alg.cra_alignmask = alg->cra_alignmask;
         inst->alg.cra_type = &crypto_hash_type;
 
-        inst->alg.cra_hash.digestsize =
-                (alg->cra_flags & CRYPTO_ALG_TYPE_MASK) ==
-                CRYPTO_ALG_TYPE_HASH ? alg->cra_hash.digestsize :
-                                       alg->cra_digest.dia_digestsize;
+        inst->alg.cra_hash.digestsize = ds;
 
         inst->alg.cra_ctxsize = sizeof(struct hmac_ctx) +
-                                ALIGN(inst->alg.cra_blocksize * 2 +
-                                      inst->alg.cra_hash.digestsize,
+                                ALIGN(inst->alg.cra_blocksize * 2 + ds,
                                       sizeof(void *));
 
         inst->alg.cra_init = hmac_init_tfm;