2.6.25-stable review patch. If anyone has any objections, please let us know. ------------------ From: Herbert Xu [CRYPTO] api: Fix scatterwalk_sg_chain [ Upstream commit: 8ec970d8561abb5645d4602433b772e268c96d05 ] When I backed out of using the generic sg chaining (as it isn't currently portable) and introduced scatterwalk_sg_chain/scatterwalk_sg_next I left out the sg_is_last check in the latter. This causes it to potentially dereference beyond the end of the sg array. As most uses of scatterwalk_sg_next are bound by an overall length, this only affected the chaining code in authenc and eseqiv. Thanks to Patrick McHardy for identifying this problem. This patch also clears the "last" bit on the head of the chained list as it's no longer last. This also went missing in scatterwalk_sg_chain and is present in sg_chain. Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- include/crypto/scatterwalk.h | 4 ++++ 1 file changed, 4 insertions(+) --- a/include/crypto/scatterwalk.h +++ b/include/crypto/scatterwalk.h @@ -57,10 +57,14 @@ static inline void scatterwalk_sg_chain( struct scatterlist *sg2) { sg_set_page(&sg1[num - 1], (void *)sg2, 0, 0); + sg1[num - 1].page_link &= ~0x02; } static inline struct scatterlist *scatterwalk_sg_next(struct scatterlist *sg) { + if (sg_is_last(sg)) + return NULL; + return (++sg)->length ? sg : (void *)sg_page(sg); } -- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/