crypto: skcipher - Fix blkcipher walk OOM crash

When we need to allocate a temporary blkcipher_walk_next and it fails, the code is supposed to take the slow path of processing the data block by block. However, due to an unrelated change we instead end up dereferencing the NULL pointer. This patch fixes it by moving the unrelated bsize setting out of the way so that we enter the slow path as inteded. Fixes: 7607bd8 ("[CRYPTO] blkcipher: Added blkcipher_walk_virt_block") Cc: [email protected] Reported-by: xiakaixu <[email protected]> Reported-by: Ard Biesheuvel <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Tested-by: Ard Biesheuvel <[email protected]>
cypheratheist · Sep 13, 2016 · acdb04d · acdb04d
1 parent 53a5d5d
commit acdb04d
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
@@ -233,6 +233,8 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
 		return blkcipher_walk_done(desc, walk, -EINVAL);
 	}
 
+	bsize = min(walk->walk_blocksize, n);
+
 	walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY |
 			 BLKCIPHER_WALK_DIFF);
 	if (!scatterwalk_aligned(&walk->in, walk->alignmask) ||
@@ -245,7 +247,6 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
 		}
 	}
 
-	bsize = min(walk->walk_blocksize, n);
 	n = scatterwalk_clamp(&walk->in, n);
 	n = scatterwalk_clamp(&walk->out, n);