public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Kees Cook <kees@kernel.org>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 6.12 08/24] crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
Date: Fri, 13 Feb 2026 14:48:27 +0100	[thread overview]
Message-ID: <20260213134705.035269738@linuxfoundation.org> (raw)
In-Reply-To: <20260213134704.728003077@linuxfoundation.org>

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kees Cook <kees@kernel.org>

commit 1562b1fb7e17c1b3addb15e125c718b2be7f5512 upstream.

The existing allocation of scatterlists in omap_crypto_copy_sg_lists()
was allocating an array of scatterlist pointers, not scatterlist objects,
resulting in a 4x too small allocation.

Use sizeof(*new_sg) to get the correct object size.

Fixes: 74ed87e7e7f7 ("crypto: omap - add base support library for common routines")
Signed-off-by: Kees Cook <kees@kernel.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/omap-crypto.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/crypto/omap-crypto.c
+++ b/drivers/crypto/omap-crypto.c
@@ -21,7 +21,7 @@ static int omap_crypto_copy_sg_lists(int
 	struct scatterlist *tmp;
 
 	if (!(flags & OMAP_CRYPTO_FORCE_SINGLE_ENTRY)) {
-		new_sg = kmalloc_array(n, sizeof(*sg), GFP_KERNEL);
+		new_sg = kmalloc_array(n, sizeof(*new_sg), GFP_KERNEL);
 		if (!new_sg)
 			return -ENOMEM;
 



  parent reply	other threads:[~2026-02-13 13:56 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-02-13 13:48 [PATCH 6.12 00/24] 6.12.72-rc1 review Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 01/24] smb: client: split cached_fid bitfields to avoid shared-byte RMW races Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 02/24] ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 03/24] smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 04/24] driver core: enforce device_lock for driver_match_device() Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 05/24] Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 06/24] crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 07/24] crypto: octeontx - Fix length check to avoid truncation in ucode_load_store Greg Kroah-Hartman
2026-02-13 13:48 ` Greg Kroah-Hartman [this message]
2026-02-13 13:48 ` [PATCH 6.12 09/24] crypto: virtio - Add spinlock protection with virtqueue notification Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 10/24] crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 11/24] nilfs2: Fix potential block overflow that cause system hang Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 12/24] wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 13/24] scsi: qla2xxx: Validate sp before freeing associated memory Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 14/24] scsi: qla2xxx: Allow recovery for tape devices Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 15/24] scsi: qla2xxx: Delay module unload while fabric scan in progress Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 16/24] scsi: qla2xxx: Free sp in error path to fix system crash Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 17/24] scsi: qla2xxx: Query FW again before proceeding with login Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 18/24] bus: mhi: host: pci_generic: Add Telit FE990B40 modem support Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 19/24] mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 20/24] erofs: fix UAF issue for file-backed mounts w/ directio option Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 21/24] xfs: fix UAF in xchk_btree_check_block_owner Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 22/24] PCI: endpoint: Avoid creating sub-groups asynchronously Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 23/24] wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add Greg Kroah-Hartman
2026-02-13 13:48 ` [PATCH 6.12 24/24] gpio: omap: do not register driver in probe() Greg Kroah-Hartman
2026-02-13 19:09 ` [PATCH 6.12 00/24] 6.12.72-rc1 review Florian Fainelli
2026-02-13 19:20 ` Jon Hunter
2026-02-13 23:54 ` Peter Schneider
2026-02-14  0:58 ` Brett Mastbergen
2026-02-14 10:42 ` Ron Economos
2026-02-14 16:01 ` Brett A C Sheffield
2026-02-14 23:58 ` Barry K. Nathan
2026-02-15  0:06 ` Miguel Ojeda
2026-02-16 14:27 ` Mark Brown
2026-02-16 15:35   ` Greg Kroah-Hartman
2026-02-16 15:47   ` Danilo Krummrich
2026-02-16 16:01     ` Danilo Krummrich

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260213134705.035269738@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=kees@kernel.org \
    --cc=patches@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox