public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Kees Cook <kees@kernel.org>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 6.6 07/25] crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
Date: Fri, 13 Feb 2026 14:48:33 +0100	[thread overview]
Message-ID: <20260213134704.154853942@linuxfoundation.org> (raw)
In-Reply-To: <20260213134703.882698935@linuxfoundation.org>

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kees Cook <kees@kernel.org>

commit 1562b1fb7e17c1b3addb15e125c718b2be7f5512 upstream.

The existing allocation of scatterlists in omap_crypto_copy_sg_lists()
was allocating an array of scatterlist pointers, not scatterlist objects,
resulting in a 4x too small allocation.

Use sizeof(*new_sg) to get the correct object size.

Fixes: 74ed87e7e7f7 ("crypto: omap - add base support library for common routines")
Signed-off-by: Kees Cook <kees@kernel.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/omap-crypto.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/crypto/omap-crypto.c
+++ b/drivers/crypto/omap-crypto.c
@@ -21,7 +21,7 @@ static int omap_crypto_copy_sg_lists(int
 	struct scatterlist *tmp;
 
 	if (!(flags & OMAP_CRYPTO_FORCE_SINGLE_ENTRY)) {
-		new_sg = kmalloc_array(n, sizeof(*sg), GFP_KERNEL);
+		new_sg = kmalloc_array(n, sizeof(*new_sg), GFP_KERNEL);
 		if (!new_sg)
 			return -ENOMEM;
 



  parent reply	other threads:[~2026-02-13 13:57 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-02-13 13:48 [PATCH 6.6 00/25] 6.6.125-rc1 review Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 01/25] smb: client: split cached_fid bitfields to avoid shared-byte RMW races Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 02/25] ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 03/25] smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 04/25] driver core: enforce device_lock for driver_match_device() Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 05/25] Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 06/25] crypto: octeontx - Fix length check to avoid truncation in ucode_load_store Greg Kroah-Hartman
2026-02-13 13:48 ` Greg Kroah-Hartman [this message]
2026-02-13 13:48 ` [PATCH 6.6 08/25] crypto: virtio - Add spinlock protection with virtqueue notification Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 09/25] crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 10/25] nilfs2: Fix potential block overflow that cause system hang Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 11/25] wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 12/25] scsi: qla2xxx: Validate sp before freeing associated memory Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 13/25] scsi: qla2xxx: Allow recovery for tape devices Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 14/25] scsi: qla2xxx: Delay module unload while fabric scan in progress Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 15/25] scsi: qla2xxx: Free sp in error path to fix system crash Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 16/25] scsi: qla2xxx: Query FW again before proceeding with login Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 17/25] net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 18/25] nfsd: dont ignore the return code of svc_proc_register() Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 19/25] netfilter: nf_tables: missing objects with no memcg accounting Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 20/25] netfilter: nft_set_pipapo: prevent overflow in lookup table allocation Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 21/25] vsock/test: verify socket options after setting them Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 22/25] spi: cadence-quadspi: Implement refcount to handle unbind during busy Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 23/25] selftests: mptcp: pm: ensure unknown flags are ignored Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 24/25] mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.6 25/25] gpio: omap: do not register driver in probe() Greg Kroah-Hartman
2026-02-13 18:53 ` [PATCH 6.6 00/25] 6.6.125-rc1 review Florian Fainelli
2026-02-13 19:20 ` Jon Hunter
2026-02-14  1:05 ` Peter Schneider
2026-02-14 10:49 ` Ron Economos
2026-02-14 16:02 ` Brett A C Sheffield
2026-02-15  0:03 ` Miguel Ojeda

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260213134704.154853942@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=kees@kernel.org \
    --cc=patches@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox