diff options
| author | Horia Geant? <horia.geanta@freescale.com> | 2015-05-12 11:28:05 +0300 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2015-05-13 10:31:57 +0800 |
| commit | bde9079f3cd5e4275be2169cf7b0c74bfb464f78 (patch) | |
| tree | 2c38b268854c68c6f524350f788b3847f0d804b7 /drivers | |
| parent | 69d9cd8c592f1abce820dbce7181bbbf6812cfbd (diff) | |
| download | linux-bde9079f3cd5e4275be2169cf7b0c74bfb464f78.tar.bz2 | |
crypto: talitos - avoid out of bound scatterlist iterator
Check return value of scatterlist_sg_next(), i.e. don't rely solely
on number of bytes to be processed or number of scatterlist entries.
Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/crypto/talitos.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c index 5f7c74d0afc3..ba5f68b987ab 100644 --- a/drivers/crypto/talitos.c +++ b/drivers/crypto/talitos.c @@ -1065,7 +1065,7 @@ static int sg_to_link_tbl(struct scatterlist *sg, int sg_count, { int n_sg = sg_count; - while (n_sg--) { + while (sg && n_sg--) { to_talitos_ptr(link_tbl_ptr, sg_dma_address(sg), 0); link_tbl_ptr->len = cpu_to_be16(sg_dma_len(sg)); link_tbl_ptr->j_extent = 0; @@ -1254,7 +1254,7 @@ static int sg_count(struct scatterlist *sg_list, int nbytes, bool *chained) int sg_nents = 0; *chained = false; - while (nbytes > 0) { + while (nbytes > 0 && sg) { sg_nents++; nbytes -= sg->length; if (!sg_is_last(sg) && (sg + 1)->length == 0) |