diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2017-02-06 14:16:23 -0800 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2017-02-06 14:16:23 -0800 |
commit | 10e158ec50f0a529947db6260e69f2ebb7bf42c8 (patch) | |
tree | a47c444990fb63cdbbd75d489b84eb9bf9e5cb13 /crypto/algif_aead.c | |
parent | ea874fbadeb1532601fef11a80f2ce21985bd402 (diff) | |
parent | 108b5beb5d963af51f9035856c9be57c1fbbbe14 (diff) | |
download | linux-crypto-10e158ec50f0a529947db6260e69f2ebb7bf42c8.tar.gz linux-crypto-10e158ec50f0a529947db6260e69f2ebb7bf42c8.zip |
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
- use-after-free in algif_aead
- modular aesni regression when pcbc is modular but absent
- bug causing IO page faults in ccp
- double list add in ccp
- NULL pointer dereference in qat (two patches)
- panic in chcr
- NULL pointer dereference in chcr
- out-of-bound access in chcr
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: chcr - Fix key length for RFC4106
crypto: algif_aead - Fix kernel panic on list_del
crypto: aesni - Fix failure when pcbc module is absent
crypto: ccp - Fix double add when creating new DMA command
crypto: ccp - Fix DMA operations when IOMMU is enabled
crypto: chcr - Check device is allocated before use
crypto: chcr - Fix panic on dma_unmap_sg
crypto: qat - zero esram only for DH85x devices
crypto: qat - fix bar discovery for c62x
Diffstat (limited to '')
-rw-r--r-- | crypto/algif_aead.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c index f849311e..533265f1 100644 --- a/crypto/algif_aead.c +++ b/crypto/algif_aead.c @@ -661,9 +661,9 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags) unlock: list_for_each_entry_safe(rsgl, tmp, &ctx->list, list) { af_alg_free_sg(&rsgl->sgl); + list_del(&rsgl->list); if (rsgl != &ctx->first_rsgl) sock_kfree_s(sk, rsgl, sizeof(*rsgl)); - list_del(&rsgl->list); } INIT_LIST_HEAD(&ctx->list); aead_wmem_wakeup(sk); |