diff options
author | Ard Biesheuvel <ard.biesheuvel@linaro.org> | 2016-11-29 13:05:31 +0000 |
---|---|---|
committer | Herbert Xu <herbert@gondor.apana.org.au> | 2016-11-30 20:01:43 +0800 |
commit | 066262f960279ed3deff4cfa23f7a7673a84df98 (patch) | |
tree | 4a90c789a9c94e625f971217696e798c61d2b5c5 | |
parent | a755fdf1edd32caf3d868b5612ab6e9c40e27fb7 (diff) | |
download | linux-crypto-066262f960279ed3deff4cfa23f7a7673a84df98.tar.gz linux-crypto-066262f960279ed3deff4cfa23f7a7673a84df98.zip |
crypto: skcipher - fix crash in skcipher_walk_aead()
The new skcipher_walk_aead() may crash in the following way due to
the walk flag SKCIPHER_WALK_PHYS not being cleared at the start of the
walk:
Unable to handle kernel NULL pointer dereference at virtual address 00000001
[..]
Internal error: Oops: 96000044 [#1] PREEMPT SMP
[..]
PC is at skcipher_walk_next+0x208/0x450
LR is at skcipher_walk_next+0x1e4/0x450
pc : [<ffff2b93b7104e20>] lr : [<ffff2b93b7104dfc>] pstate: 40000045
sp : ffffb925fa517940
[...]
[<ffff2b93b7104e20>] skcipher_walk_next+0x208/0x450
[<ffff2b93b710535c>] skcipher_walk_first+0x54/0x148
[<ffff2b93b7105664>] skcipher_walk_aead+0xd4/0x108
[<ffff2b93b6e77928>] ccm_encrypt+0x68/0x158
So clear the flag at the appropriate time.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to '')
-rw-r--r-- | crypto/skcipher.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/crypto/skcipher.c b/crypto/skcipher.c index 0f307199..5367f817 100644 --- a/crypto/skcipher.c +++ b/crypto/skcipher.c @@ -506,6 +506,8 @@ int skcipher_walk_aead(struct skcipher_walk *walk, struct aead_request *req, struct crypto_aead *tfm = crypto_aead_reqtfm(req); int err; + walk->flags &= ~SKCIPHER_WALK_PHYS; + scatterwalk_start(&walk->in, req->src); scatterwalk_start(&walk->out, req->dst); |