Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f27eb3af authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  [CRYPTO] api: fix writting into unallocated memory in setkey_aligned
parents 6f605d83 06817176

crypto/ablkcipher.c

+1 −1
Original line number Diff line number Diff line
@@ -35,7 +35,7 @@ static int setkey_unaligned(struct crypto_ablkcipher *tfm, const u8 *key, unsign 
	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);

	memcpy(alignbuffer, key, keylen);

	ret = cipher->setkey(tfm, alignbuffer, keylen);

	memset(alignbuffer, 0, absize);

	memset(alignbuffer, 0, keylen);

	kfree(buffer);

	return ret;

}

crypto/blkcipher.c

+1 −1
Original line number Diff line number Diff line
@@ -352,7 +352,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key, unsigned int 
	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);

	memcpy(alignbuffer, key, keylen);

	ret = cipher->setkey(tfm, alignbuffer, keylen);

	memset(alignbuffer, 0, absize);

	memset(alignbuffer, 0, keylen);

	kfree(buffer);

	return ret;

}

crypto/cipher.c

+1 −1
Original line number Diff line number Diff line
@@ -36,7 +36,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key, unsigned int 
	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);

	memcpy(alignbuffer, key, keylen);

	ret = cia->cia_setkey(tfm, alignbuffer, keylen);

	memset(alignbuffer, 0, absize);

	memset(alignbuffer, 0, keylen);

	kfree(buffer);

	return ret;

crypto/hash.c

+1 −1
Original line number Diff line number Diff line
@@ -40,7 +40,7 @@ static int hash_setkey_unaligned(struct crypto_hash *crt, const u8 *key, 
	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);

	memcpy(alignbuffer, key, keylen);

	ret = alg->setkey(crt, alignbuffer, keylen);

	memset(alignbuffer, 0, absize);

	memset(alignbuffer, 0, keylen);

	kfree(buffer);

	return ret;

}