Re: [GIT] Networking
From: David Miller
Date: Mon Feb 09 2015 - 23:52:16 EST
From: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Date: Mon, 9 Feb 2015 20:37:13 -0800
> It's a NULL pointer derefernce (at offset 0x18) where the callchain
> looks like this:
> RIP: skcipher_recvmsg+0x360/0x410
> Call Trace:
> which I assume is related to the iov_iter conversion.
> That oops then is followed immediately by another that is a NULL
> pointer dereference in skcipher_sock_destruct, but the callchain for
> that is just the exit as part of killing of the original oops, so that
> second oops seems to be just a result of the first one.
> I'm assuming the culrpit is 1d10eb2f156f ("crypto: switch
> af_alg_make_sg() to iov_iter") but haven't tested.
I think the handling of the 'used' local variable for function
skcipher_recvmsg() in that commit is suspect.
The problem is that if we go to the skcipher_wait_for_data() code
path, ctx->used is updated.
But the way skcipher_recvmsg() is was changed, that update won't
propagate into the caller because the old ctx->used value is cached in
the local 'used' variable.
The fix could be as simple as:
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 37110fd..4d1c315 100644
@@ -444,6 +444,7 @@ static int skcipher_recvmsg(struct kiocb *unused, struct socket *sock,
err = skcipher_wait_for_data(sk, flags);
+ used = ctx->used;
used = min_t(unsigned long, used, iov_iter_count(&msg->msg_iter));
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/