Commit dcf7d9e0 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'v6.17-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 

Pull crypto fixes from Herbert Xu:
 "This fixes a NULL pointer dereference in ccp and a couple of bugs in
  the af_alg interface"

* tag 'v6.17-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
  crypto: af_alg - Set merge to zero early in af_alg_sendmsg
  crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked()
parents e8442d5b 1b34cbbf

crypto/af_alg.c

+9 −1
Original line number Diff line number Diff line
@@ -970,6 +970,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, 
	}



	lock_sock(sk);

	if (ctx->write) {

		release_sock(sk);

		return -EBUSY;

	}

	ctx->write = true;



	if (ctx->init && !ctx->more) {

		if (ctx->used) {

			err = -EINVAL;
@@ -1019,6 +1025,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, 
			continue;

		}



		ctx->merge = 0;



		if (!af_alg_writable(sk)) {

			err = af_alg_wait_for_wmem(sk, msg->msg_flags);

			if (err)
@@ -1058,7 +1066,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, 
			ctx->used += plen;

			copied += plen;

			size -= plen;

			ctx->merge = 0;

		} else {

			do {

				struct page *pg;
@@ -1104,6 +1111,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, 


unlock:

	af_alg_data_wakeup(sk);

	ctx->write = false;

	release_sock(sk);



	return copied ?: err;

drivers/crypto/ccp/sev-dev.c

+1 −1
Original line number Diff line number Diff line
@@ -2430,7 +2430,7 @@ static void __sev_firmware_shutdown(struct sev_device *sev, bool panic) 
{

	int error;



	__sev_platform_shutdown_locked(NULL);

	__sev_platform_shutdown_locked(&error);



	if (sev_es_tmr) {

		/*

include/crypto/if_alg.h

+6 −4
Original line number Diff line number Diff line
@@ -135,6 +135,7 @@ struct af_alg_async_req { 
 *			SG?

 * @enc:		Cryptographic operation to be performed when

 *			recvmsg is invoked.

 * @write:		True if we are in the middle of a write.

 * @init:		True if metadata has been sent.

 * @len:		Length of memory allocated for this data structure.

 * @inflight:		Non-zero when AIO requests are in flight.
@@ -151,10 +152,11 @@ struct af_alg_ctx { 
	size_t used;

	atomic_t rcvused;



	bool more;

	bool merge;

	bool enc;

	bool init;

	u32		more:1,

			merge:1,

			enc:1,

			write:1,

			init:1;



	unsigned int len;