Commit 202736d9 authored Jan 19, 2016 by Herbert Xu

crypto: algif_skcipher - sendmsg SG marking is off by one



We mark the end of the SG list in sendmsg and sendpage and unmark
it on the next send call.  Unfortunately the unmarking in sendmsg
is off-by-one, leading to an SG list that is too short.

Fixes: 0f477b65 ("crypto: algif - Mark sgl end at the end of data")
Cc: stable@vger.kernel.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

parent fd7f6727

crypto/algif_skcipher.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -392,7 +392,8 @@ static int skcipher_sendmsg(struct socket sock, struct msghdr msg,

		sgl = list_entry(ctx->tsgl.prev, struct skcipher_sg_list, list);
		sg = sgl->sg;
		sg_unmark_end(sg + sgl->cur);
		if (sgl->cur)
		sg_unmark_end(sg + sgl->cur - 1);
		do {
		i = sgl->cur;
		plen = min_t(size_t, len, PAGE_SIZE);

Admin message