diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2025-09-19 09:58:21 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2025-09-19 09:58:21 -0700 |
| commit | dcf7d9e0aee523e588aa3d5ce7394043cd2dea9e (patch) | |
| tree | c7edbafc25f2a93c75366dae1b1ab08e76372b75 /crypto | |
| parent | e8442d5b7bc6338d553040f5b1f7bd43f5ab30e0 (diff) | |
| parent | 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 (diff) | |
| download | linux-dcf7d9e0aee523e588aa3d5ce7394043cd2dea9e.tar.gz linux-dcf7d9e0aee523e588aa3d5ce7394043cd2dea9e.tar.bz2 linux-dcf7d9e0aee523e588aa3d5ce7394043cd2dea9e.zip | |
Merge tag 'v6.17-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
"This fixes a NULL pointer dereference in ccp and a couple of bugs in
the af_alg interface"
* tag 'v6.17-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
crypto: af_alg - Set merge to zero early in af_alg_sendmsg
crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked()
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/af_alg.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/crypto/af_alg.c b/crypto/af_alg.c index 0da7c1ac778a..ca6fdcc6c54a 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -970,6 +970,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, } lock_sock(sk); + if (ctx->write) { + release_sock(sk); + return -EBUSY; + } + ctx->write = true; + if (ctx->init && !ctx->more) { if (ctx->used) { err = -EINVAL; @@ -1019,6 +1025,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, continue; } + ctx->merge = 0; + if (!af_alg_writable(sk)) { err = af_alg_wait_for_wmem(sk, msg->msg_flags); if (err) @@ -1058,7 +1066,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, ctx->used += plen; copied += plen; size -= plen; - ctx->merge = 0; } else { do { struct page *pg; @@ -1104,6 +1111,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, unlock: af_alg_data_wakeup(sk); + ctx->write = false; release_sock(sk); return copied ?: err; |