From: Kamal Mostafa <kamal@canonical.com>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
kernel-team@lists.ubuntu.com
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
Kamal Mostafa <kamal@canonical.com>
Subject: [PATCH 4.2.y-ckt 08/53] crypto: hash - Fix page length clamping in hash walk
Date: Tue, 24 May 2016 10:54:38 -0700 [thread overview]
Message-ID: <1464112523-3701-9-git-send-email-kamal@canonical.com> (raw)
In-Reply-To: <1464112523-3701-1-git-send-email-kamal@canonical.com>
4.2.8-ckt11 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
commit 13f4bb78cf6a312bbdec367ba3da044b09bf0e29 upstream.
The crypto hash walk code is broken when supplied with an offset
greater than or equal to PAGE_SIZE. This patch fixes it by adjusting
walk->pg and walk->offset when this happens.
Reported-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
crypto/ahash.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/crypto/ahash.c b/crypto/ahash.c
index d19b523..dac1c24 100644
--- a/crypto/ahash.c
+++ b/crypto/ahash.c
@@ -69,8 +69,9 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk)
struct scatterlist *sg;
sg = walk->sg;
- walk->pg = sg_page(sg);
walk->offset = sg->offset;
+ walk->pg = sg_page(walk->sg) + (walk->offset >> PAGE_SHIFT);
+ walk->offset = offset_in_page(walk->offset);
walk->entrylen = sg->length;
if (walk->entrylen > walk->total)
--
2.7.4
next prev parent reply other threads:[~2016-05-24 18:12 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-24 17:54 [4.2.y-ckt stable] Linux 4.2.8-ckt11 stable review Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 01/53] [4.2-stable only] fix backport "IB/security: restrict use of the write() interface" Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 02/53] Revert "usb: hub: do not clear BOS field during reset device" Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 03/53] regulator: s2mps11: Fix invalid selector mask and voltages for buck9 Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 04/53] regmap: spmi: Fix regmap_spmi_ext_read in multi-byte case Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 05/53] ALSA: usb-audio: Quirk for yet another Phoenix Audio devices (v2) Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 06/53] atomic_open(): fix the handling of create_error Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 07/53] drm/i915/bdw: Add missing delay during L3 SQC credit programming Kamal Mostafa
2016-05-24 17:54 ` Kamal Mostafa [this message]
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 09/53] drm/radeon: fix DP link training issue with second 4K monitor Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 10/53] drm/radeon: fix PLL sharing on DCE6.1 (v2) Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 11/53] get_rock_ridge_filename(): handle malformed NM entries Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 12/53] ALSA: hda - Fix white noise on Asus UX501VW headset Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 13/53] Input: max8997-haptic - fix NULL pointer dereference Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 14/53] drm/i915: Bail out of pipe config compute loop on LPT Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 15/53] ALSA: hda - Fix broken reconfig Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 16/53] ALSA: hda - Fix subwoofer pin on ASUS N751 and N551 Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 17/53] vfs: add vfs_select_inode() helper Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 18/53] vfs: rename: check backing inode being equal Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 19/53] ALSA: usb-audio: Yet another Phoneix Audio device quirk Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 20/53] perf/x86: Fix undefined shift on 32-bit kernels Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 21/53] perf/x86/intel/pt: Generate PMI in the STOP region as well Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 22/53] perf/core: Disable the event on a truncated AUX record Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 23/53] tools lib traceevent: Do not reassign parg after collapse_tree() Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 24/53] workqueue: fix rebind bound workers warning Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 25/53] ocfs2: fix posix_acl_create deadlock Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 26/53] nf_conntrack: avoid kernel pointer value leak in slab name Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 27/53] macvtap: segmented packet is consumed Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 28/53] regulator: axp20x: Fix axp22x ldo_io voltage ranges Kamal Mostafa
2016-05-24 17:54 ` [PATCH 4.2.y-ckt 29/53] arm64: bpf: jit JMP_JSET_{X,K} Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 30/53] bridge: fix igmp / mld query parsing Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 31/53] net/mlx4_en: Fix endianness bug in IPV6 csum calculation Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 32/53] net: fec: only clear a queue's work bit if the queue was emptied Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 33/53] tcp: refresh skb timestamp at retransmit time Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 34/53] net/route: enforce hoplimit max value Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 35/53] decnet: Do not build routes to devices without decnet private data Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 36/53] route: do not cache fib route info on local routes with oif Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 37/53] net: use skb_postpush_rcsum instead of own implementations Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 38/53] vlan: pull on __vlan_insert_tag error path and fix csum correction Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 39/53] ipv4/fib: don't warn when primary address is missing if in_dev is dead Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 40/53] bpf: fix double-fdput in replace_map_fd_with_map_ptr() Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 41/53] net_sched: introduce qdisc_replace() helper Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 42/53] net_sched: update hierarchical backlog too Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 43/53] sch_htb: update backlog as well Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 44/53] sch_dsmark: " Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 45/53] netem: Segment GSO packets on enqueue Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 46/53] net: fix infoleak in llc Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 47/53] net: fix infoleak in rtnetlink Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 48/53] VSOCK: do not disconnect socket when peer has shutdown SEND only Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 49/53] net: bridge: fix old ioctl unlocked net device walk Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 50/53] net: fix a kernel infoleak in x25 module Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 51/53] cdc_mbim: apply "NDP to end" quirk to all Huawei devices Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 52/53] soreuseport: fix ordering for mixed v4/v6 sockets Kamal Mostafa
2016-05-24 17:55 ` [PATCH 4.2.y-ckt 53/53] uapi glibc compat: fix compile errors when glibc net/if.h included before linux/if.h Kamal Mostafa
2016-05-25 7:22 ` Mikko Rapeli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1464112523-3701-9-git-send-email-kamal@canonical.com \
--to=kamal@canonical.com \
--cc=herbert@gondor.apana.org.au \
--cc=kernel-team@lists.ubuntu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).