Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

crypto: talitos - avoid out of bound scatterlist iterator

Check return value of scatterlist_sg_next(), i.e. don't rely solely
on number of bytes to be processed or number of scatterlist entries.

Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

authored by

Horia Geant? and committed by
Herbert Xu
bde9079f 69d9cd8c

+2 -2
+2 -2
drivers/crypto/talitos.c
··· 1065 1065 { 1066 1066 int n_sg = sg_count; 1067 1067 1068 - while (n_sg--) { 1068 + while (sg && n_sg--) { 1069 1069 to_talitos_ptr(link_tbl_ptr, sg_dma_address(sg), 0); 1070 1070 link_tbl_ptr->len = cpu_to_be16(sg_dma_len(sg)); 1071 1071 link_tbl_ptr->j_extent = 0; ··· 1254 1254 int sg_nents = 0; 1255 1255 1256 1256 *chained = false; 1257 - while (nbytes > 0) { 1257 + while (nbytes > 0 && sg) { 1258 1258 sg_nents++; 1259 1259 nbytes -= sg->length; 1260 1260 if (!sg_is_last(sg) && (sg + 1)->length == 0)