diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2017-09-01 10:30:03 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2017-09-01 10:30:03 -0700 |
| commit | a1c516a60a702630347e27c7beb7f2f44ca7a8b5 (patch) | |
| tree | bfb6c8d70457ff7596ebdba8f0d9c1233bffa93f /lib | |
| parent | e89ce1f89f62c7e527db3850a91dab3389772af3 (diff) | |
| parent | 445a582738de6802669aeed9c33ca406c23c3b1f (diff) | |
| download | linux-a1c516a60a702630347e27c7beb7f2f44ca7a8b5.tar.gz linux-a1c516a60a702630347e27c7beb7f2f44ca7a8b5.tar.bz2 linux-a1c516a60a702630347e27c7beb7f2f44ca7a8b5.zip | |
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
"This fixes the following issues:
- Regression in chacha20 handling of chunked input
- Crash in algif_skcipher when used with async io
- Potential bogus pointer dereference in lib/mpi"
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: algif_skcipher - only call put_page on referenced and used pages
crypto: testmgr - add chunked test cases for chacha20
crypto: chacha20 - fix handling of chunked input
lib/mpi: kunmap after finishing accessing buffer
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/mpi/mpicoder.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c index 5a0f75a3bf01..eead4b339466 100644 --- a/lib/mpi/mpicoder.c +++ b/lib/mpi/mpicoder.c @@ -364,11 +364,11 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) } miter.consumed = lzeros; - sg_miter_stop(&miter); nbytes -= lzeros; nbits = nbytes * 8; if (nbits > MAX_EXTERN_MPI_BITS) { + sg_miter_stop(&miter); pr_info("MPI: mpi too large (%u bits)\n", nbits); return NULL; } @@ -376,6 +376,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) if (nbytes > 0) nbits -= count_leading_zeros(*buff) - (BITS_PER_LONG - 8); + sg_miter_stop(&miter); + nlimbs = DIV_ROUND_UP(nbytes, BYTES_PER_MPI_LIMB); val = mpi_alloc(nlimbs); if (!val) |