]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
crypto: ablkcipher - fix crash flushing dcache in error path
authorEric Biggers <ebiggers@google.com>
Mon, 23 Jul 2018 17:54:58 +0000 (10:54 -0700)
committerJuerg Haefliger <juergh@canonical.com>
Wed, 24 Jul 2019 01:42:10 +0000 (19:42 -0600)
commit6dc3ca5200247b7db0435c8b426248edfc597e2b
tree25ba0f0508ac6fb6fb5825c90a0f0badccaebb35
parenta2a653437ed4ce7b471536d38328a8e4d3430b9c
crypto: ablkcipher - fix crash flushing dcache in error path

BugLink: https://bugs.launchpad.net/bugs/1835845
commit 318abdfbe708aaaa652c79fb500e9bd60521f9dc upstream.

Like the skcipher_walk and blkcipher_walk cases:

scatterwalk_done() is only meant to be called after a nonzero number of
bytes have been processed, since scatterwalk_pagedone() will flush the
dcache of the *previous* page.  But in the error case of
ablkcipher_walk_done(), e.g. if the input wasn't an integer number of
blocks, scatterwalk_done() was actually called after advancing 0 bytes.
This caused a crash ("BUG: unable to handle kernel paging request")
during '!PageSlab(page)' on architectures like arm and arm64 that define
ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE, provided that the input was
page-aligned as in that case walk->offset == 0.

Fix it by reorganizing ablkcipher_walk_done() to skip the
scatterwalk_advance() and scatterwalk_done() if an error has occurred.

Reported-by: Liu Chao <liuchao741@huawei.com>
Fixes: bf06099db18a ("crypto: skcipher - Add ablkcipher_walk interfaces")
Cc: <stable@vger.kernel.org> # v2.6.35+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
crypto/ablkcipher.c