crypto: hash - Fix handling of small unaligned buffers

If a scatterwalk chain contains an entry with an unaligned offset then hash_walk_next() will cut off the next step at the next alignment point. However, if the entry ends before the next alignment point then we a loop, which leads to a kernel oops. Fix this by checking whether the next aligment point is before the end of the current entry. Signed-off-by: Szilveszter Ördög <[email protected]> Acked-by: David S. Miller <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
ambv · Aug 6, 2010 · 23a75ee · 23a75ee
1 parent fc1caf6
commit 23a75ee
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/crypto/ahash.c b/crypto/ahash.c
@@ -47,8 +47,11 @@ static int hash_walk_next(struct crypto_hash_walk *walk)
 	walk->data = crypto_kmap(walk->pg, 0);
 	walk->data += offset;
 
-	if (offset & alignmask)
-		nbytes = alignmask + 1 - (offset & alignmask);
+	if (offset & alignmask) {
+		unsigned int unaligned = alignmask + 1 - (offset & alignmask);
+		if (nbytes > unaligned)
+			nbytes = unaligned;
+	}
 
 	walk->entrylen -= nbytes;
 	return nbytes;