Skip to contentSkip to conversation

crypto: algif_aead: After having been compared to a NULL value at algif_aead.c:191, pointer 'tsgl_src' is passed as 2nd parameter in call to function 'crypto_aead_copy_sgl' at algif_aead.c:244, where it is dereferenced at algif_aead.c:85.

PATCH In review Alexander Sapozhnikov 2 participants 2 messages Jun 6, 2024 Crypto API

lore
Share & tools
lore

Alexander Sapozhnikov

author
#0 lore raw

PATCH 1/1 crypto: algif_aead: After having been compared to a NULL value at algif_aead.c:191, pointer 'tsgl_src' is passed as 2nd parameter in call to function 'crypto_aead_copy_sgl' at algif_aead.c:244, where it is dereferenced at algif_aead.c:85.

From: Alexandr Sapozhnikov <[email protected]>

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by Alexandr Sapozhnikov <[email protected]>
---
 crypto/algif_aead.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/algif_aead.c +1 -1
index 42493b4..f757907 100644
@@ -191,7 +191,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
 		if (tsgl_src)
 			break;
 	}
-	if (processed && !tsgl_src) {
+	if (processed || !tsgl_src) {
 		err = -EFAULT;
 		goto free;
 	}
Signature · 1 line
2.5.3
#1 lore raw
Quoted 14 lines · Alexander Sapozhnikov

From: Alexandr Sapozhnikov <[email protected]>

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by Alexandr Sapozhnikov <[email protected]>
---
 crypto/algif_aead.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/algif_aead.c +0 -0
index 42493b4..f757907 100644

crypto/algif_aead.c static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, · line 197

Quoted 8 lines
crypto/algif_aead.c +1 -1
@@ -191,7 +191,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
 		if (tsgl_src)
 			break;
 	}
-	if (processed && !tsgl_src) {
+	if (processed || !tsgl_src) {
 		err = -EFAULT;
 		goto free;
 	}

Please see
https://www.kernel.org/doc/html/latest/process/submitting-patches.html#the-canonical-patch-format
and format your subject line accordingly.

Thanks,
Easwar