diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-04-12 08:11:02 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-04-12 08:11:02 -0700 |
| commit | 8648ac819d4bc08f7d2a1e0bc9ec2d83de31f19d (patch) | |
| tree | cbae1e7a9f157adee5a9b2c3fde23f88204f2c78 /crypto/af_alg.c | |
| parent | f5459048c38a00fc583658d6dcd0f894aff6df8f (diff) | |
| parent | 3d14bd48e3a77091cbce637a12c2ae31b4a1687c (diff) | |
| download | linux-8648ac819d4bc08f7d2a1e0bc9ec2d83de31f19d.tar.gz linux-8648ac819d4bc08f7d2a1e0bc9ec2d83de31f19d.zip | |
Merge tag 'v7.0-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
- Enforce rx socket buffer limit in af_alg
- Fix array overflow in af_alg_pull_tsgl
- Fix out-of-bounds access when parsing extensions in X.509
- Fix minimum rx size check in algif_aead
* tag 'v7.0-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: algif_aead - Fix minimum RX size check for decryption
X.509: Fix out-of-bounds access when parsing extensions
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
crypto: af_alg - limit RX SG extraction by receive buffer budget
Diffstat (limited to 'crypto/af_alg.c')
| -rw-r--r-- | crypto/af_alg.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/crypto/af_alg.c b/crypto/af_alg.c index 8e0199394984d..dd0e5be4d8c07 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -705,8 +705,8 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst) * Assumption: caller created af_alg_count_tsgl(len) * SG entries in dst. */ - if (dst) { - /* reassign page to dst after offset */ + if (dst && plen) { + /* reassign page to dst */ get_page(page); sg_set_page(dst + j, page, plen, sg[i].offset); j++; @@ -1229,6 +1229,8 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, seglen = min_t(size_t, (maxsize - len), msg_data_left(msg)); + /* Never pin more pages than the remaining RX accounting budget. */ + seglen = min_t(size_t, seglen, af_alg_rcvbuf(sk)); if (list_empty(&areq->rsgl_list)) { rsgl = &areq->first_rsgl; |