Skip to contentSkip to conversation

crypto: fix potential NULL pointer dereference in skcipher_alloc_sgl()

PATCH In review Jeff Liu 2 participants 2 messages Nov 15, 2013 – Nov 28, 2013 Crypto API

lore
Share & tools
lore

Jeff Liu

author
#0 lore raw

PATCH 1/1 crypto: fix potential NULL pointer dereference in skcipher_alloc_sgl()

From: Jie Liu <[email protected]>

In skcipher_alloc_sgl(), there is a potential null pointer dereference issue to retrieve the last item from ctx->tsgl list if the list is empty.

This patch fix it by checking if the list is empty or not at first.

Signed-off-by Jie Liu <[email protected]>
---
 crypto/algif_skcipher.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
crypto/algif_skcipher.c +3 -2
index a1c4f0a..bfa702e 100644
@@ -73,9 +73,10 @@ static int skcipher_alloc_sgl(struct sock *sk)
 	struct skcipher_sg_list *sgl;
 	struct scatterlist *sg = NULL;
 
-	sgl = list_entry(ctx->tsgl.prev, struct skcipher_sg_list, list);
-	if (!list_empty(&ctx->tsgl))
+	if (!list_empty(&ctx->tsgl)) {
+		sgl = list_entry(ctx->tsgl.prev, struct skcipher_sg_list, list);
 		sg = sgl->sg;
+	}
 
 	if (!sg || sgl->cur >= MAX_SGL_ENTS) {
 		sgl = sock_kmalloc(sk, sizeof(*sgl) +
Signature · 1 line
1.8.3.2
maintainer
#1 lore raw
Quoted 8 lines · Jeff Liu

From: Jie Liu <[email protected]>

In skcipher_alloc_sgl(), there is a potential null pointer dereference issue to retrieve the last item from ctx->tsgl list if the list is empty.

This patch fix it by checking if the list is empty or not at first.

Signed-off-by Jie Liu <[email protected]>

Were you actually able to make this crash?

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt