* [PATCH] crypto: fix potential NULL pointer dereference in skcipher_alloc_sgl()
@ 2013-11-15 2:31 Jeff Liu
2013-11-28 13:52 ` Herbert Xu
0 siblings, 1 reply; 2+ messages in thread
From: Jeff Liu @ 2013-11-15 2:31 UTC (permalink / raw)
To: linux-crypto; +Cc: herbert, davem
From: Jie Liu <jeff.liu@oracle.com>
In skcipher_alloc_sgl(), there is a potential null pointer dereference
issue to retrieve the last item from ctx->tsgl list if the list is empty.
This patch fix it by checking if the list is empty or not at first.
Signed-off-by: Jie Liu <jeff.liu@oracle.com>
---
crypto/algif_skcipher.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index a1c4f0a..bfa702e 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -73,9 +73,10 @@ static int skcipher_alloc_sgl(struct sock *sk)
struct skcipher_sg_list *sgl;
struct scatterlist *sg = NULL;
- sgl = list_entry(ctx->tsgl.prev, struct skcipher_sg_list, list);
- if (!list_empty(&ctx->tsgl))
+ if (!list_empty(&ctx->tsgl)) {
+ sgl = list_entry(ctx->tsgl.prev, struct skcipher_sg_list, list);
sg = sgl->sg;
+ }
if (!sg || sgl->cur >= MAX_SGL_ENTS) {
sgl = sock_kmalloc(sk, sizeof(*sgl) +
--
1.8.3.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-11-28 13:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-11-15 2:31 [PATCH] crypto: fix potential NULL pointer dereference in skcipher_alloc_sgl() Jeff Liu
2013-11-28 13:52 ` Herbert Xu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).