Commit 04737196 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'v6.8-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 

Pull crypto fixes from Herbert Xu:
 "Fix regressions in cbc and algif_hash, as well as an older
  NULL-pointer dereference in ccp"

* tag 'v6.8-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: algif_hash - Remove bogus SGL free on zero-length error path
  crypto: cbc - Ensure statesize is zero
  crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
parents 860d7dcb 24c890dd

crypto/algif_hash.c

+3 −2
Original line number Diff line number Diff line
@@ -91,13 +91,13 @@ static int hash_sendmsg(struct socket *sock, struct msghdr *msg, 
		if (!(msg->msg_flags & MSG_MORE)) {

			err = hash_alloc_result(sk, ctx);

			if (err)

				goto unlock_free;

				goto unlock_free_result;

			ahash_request_set_crypt(&ctx->req, NULL,

						ctx->result, 0);

			err = crypto_wait_req(crypto_ahash_final(&ctx->req),

					      &ctx->wait);

			if (err)

				goto unlock_free;

				goto unlock_free_result;

		}

		goto done_more;

	}
@@ -170,6 +170,7 @@ static int hash_sendmsg(struct socket *sock, struct msghdr *msg, 


unlock_free:

	af_alg_free_sg(&ctx->sgl);

unlock_free_result:

	hash_free_result(sk, ctx);

	ctx->more = false;

	goto unlock;

crypto/cbc.c

+3 −0
Original line number Diff line number Diff line
@@ -148,6 +148,9 @@ static int crypto_cbc_create(struct crypto_template *tmpl, struct rtattr **tb) 
	if (!is_power_of_2(inst->alg.co.base.cra_blocksize))

		goto out_free_inst;



	if (inst->alg.co.statesize)

		goto out_free_inst;



	inst->alg.encrypt = crypto_cbc_encrypt;

	inst->alg.decrypt = crypto_cbc_decrypt;

drivers/crypto/ccp/sev-dev.c

+8 −2
Original line number Diff line number Diff line
@@ -534,10 +534,16 @@ EXPORT_SYMBOL_GPL(sev_platform_init); 


static int __sev_platform_shutdown_locked(int *error)

{

	struct sev_device *sev = psp_master->sev_data;

	struct psp_device *psp = psp_master;

	struct sev_device *sev;

	int ret;



	if (!sev || sev->state == SEV_STATE_UNINIT)

	if (!psp || !psp->sev_data)

		return 0;



	sev = psp->sev_data;



	if (sev->state == SEV_STATE_UNINIT)

		return 0;



	ret = __sev_do_cmd_locked(SEV_CMD_SHUTDOWN, NULL, error);