Re: scatterwalk.c: Nullpointer dereference

Am Montag, 14. August 2017, 14:25:49 CEST schrieb Plauth, Max:

Hi Max,

Dear linux-crypto community,

I think I might have run into a bug in crypto/scatterwalk.c:
- at the end of scatterwalk_pagedone, sg_next(walk->sg) is fed as an
argument to scatterwalk_start(...) - sg_next (lib/scatterlist.c) returns
NULL in the case of sg_is_last(sg) - In this case, NULL is being fed into
scatterwalk_start
- there, a NULL value of *sg leads to a NULL pointer dereference:
walk->sg = sg;
walk->offset = sg->offset;

I stumbled across this issue when I tried to extend the cryptodev-linux
Kernel module with support for compression algorithms
(https://github.com/plauth/cryptodev-linux).

You are quite right that this looks like a nullpointer. But you should never 
run into this problem because the scatterwalk length definition should ensure 
that this never happens. I.e. the scatterwalk length should not be longer than 
the underlying SGL.

Thus, the bug you report is rather a bug in the scatterlist / scatterwalk 
length definition.

Ciao
Stephan