diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2018-01-12 09:47:58 -0800 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2018-01-12 09:47:58 -0800 |
commit | 21864b027d847a6d91903a5ba219770403ba8aad (patch) | |
tree | 2bf17da93b86508fe2f66e87f39897a1d4b403dc | |
parent | be00508f4dd82c9ab747f645c769c3c906ecc73f (diff) | |
parent | 943ddbe6844bac46e38c045cbdc5bc4563c348fd (diff) | |
download | linux-crypto-21864b027d847a6d91903a5ba219770403ba8aad.tar.gz linux-crypto-21864b027d847a6d91903a5ba219770403ba8aad.zip |
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fix from Herbert Xu:
"This fixes a NULL pointer dereference in crypto_remove_spawns that can
be triggered through af_alg"
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: algapi - fix NULL dereference in crypto_remove_spawns()
Diffstat (limited to '')
-rw-r--r-- | crypto/algapi.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/crypto/algapi.c b/crypto/algapi.c index 60d7366e..9a636f96 100644 --- a/crypto/algapi.c +++ b/crypto/algapi.c @@ -167,6 +167,18 @@ void crypto_remove_spawns(struct crypto_alg *alg, struct list_head *list, spawn->alg = NULL; spawns = &inst->alg.cra_users; + + /* + * We may encounter an unregistered instance here, since + * an instance's spawns are set up prior to the instance + * being registered. An unregistered instance will have + * NULL ->cra_users.next, since ->cra_users isn't + * properly initialized until registration. But an + * unregistered instance cannot have any users, so treat + * it the same as ->cra_users being empty. + */ + if (spawns->next == NULL) + break; } } while ((spawns = crypto_more_spawns(alg, &stack, &top, &secondary_spawns))); |