diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2018-07-19 07:32:44 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2018-07-19 07:32:44 -0700 |
| commit | b4394c34356180adb783a5cba2aee469e76a52ff (patch) | |
| tree | 090470e250b8d95ffd5acfc947cf877102de0eac | |
| parent | 024ddc0ce1049298bd3cae60ae45d9c5f0fb8b9c (diff) | |
| parent | 2546da99212f22034aecf279da9c47cbfac6c981 (diff) | |
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fix from Herbert Xu:
"This fixes an allocation error-path bug in af_alg discovered by
syzkaller"
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: af_alg - Initialize sg_num_bytes in error code path
| -rw-r--r-- | crypto/af_alg.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/crypto/af_alg.c b/crypto/af_alg.c index 314c52c967e5..c166f424871c 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -1155,8 +1155,10 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, /* make one iovec available as scatterlist */ err = af_alg_make_sg(&rsgl->sgl, &msg->msg_iter, seglen); - if (err < 0) + if (err < 0) { + rsgl->sg_num_bytes = 0; return err; + } /* chain the new scatterlist with previous one */ if (areq->last_rsgl) |