Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bde9079f authored by Horia Geant?'s avatar Horia Geant? Committed by Herbert Xu
Browse files

crypto: talitos - avoid out of bound scatterlist iterator 



Check return value of scatterlist_sg_next(), i.e. don't rely solely
on number of bytes to be processed or number of scatterlist entries.

Signed-off-by: default avatarHoria Geanta <horia.geanta@freescale.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 69d9cd8c

drivers/crypto/talitos.c

+2 −2
Original line number Diff line number Diff line
@@ -1065,7 +1065,7 @@ static int sg_to_link_tbl(struct scatterlist *sg, int sg_count, 
{

	int n_sg = sg_count;



	while (n_sg--) {

	while (sg && n_sg--) {

		to_talitos_ptr(link_tbl_ptr, sg_dma_address(sg), 0);

		link_tbl_ptr->len = cpu_to_be16(sg_dma_len(sg));

		link_tbl_ptr->j_extent = 0;
@@ -1254,7 +1254,7 @@ static int sg_count(struct scatterlist *sg_list, int nbytes, bool *chained) 
	int sg_nents = 0;



	*chained = false;

	while (nbytes > 0) {

	while (nbytes > 0 && sg) {

		sg_nents++;

		nbytes -= sg->length;

		if (!sg_is_last(sg) && (sg + 1)->length == 0)