Re: general protection fault in af_alg_free_areq_sgls
From: Stephan Mueller <hidden>
Date: 2017-11-28 09:11:00
Also in:
lkml
Possibly related (same subject, not in this thread)
- 2017-12-01 · Re: general protection fault in af_alg_free_areq_sgls · Eric Biggers <hidden>
- 2017-12-01 · general protection fault in af_alg_free_areq_sgls · syzbot <hidden>
Am Dienstag, 28. November 2017, 10:02:52 CET schrieb Eric Biggers: Hi Eric,
quoted hunk ↗ jump to hunk
--- crypto/af_alg.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)diff --git a/crypto/af_alg.c b/crypto/af_alg.c index 358749c38894..415a54ced4d6 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c@@ -672,14 +672,15 @@ void af_alg_free_areq_sgls(struct af_alg_async_req*areq) } tsgl = areq->tsgl; - for_each_sg(tsgl, sg, areq->tsgl_entries, i) { - if (!sg_page(sg)) - continue; - put_page(sg_page(sg)); - } + if (tsgl) { + for_each_sg(tsgl, sg, areq->tsgl_entries, i) { + if (!sg_page(sg)) + continue; + put_page(sg_page(sg)); + } - if (areq->tsgl && areq->tsgl_entries)
Why do you want to remove the check for areq->tsgl_entries? I know in the current code that cannot happen. But it should be caught in case of a programming error. Thus, should we add a BUG_ON(!areq->tsgl_entries)? Otherwise: Reviewed-by: Stephan Mueller <redacted> Ciao Stephan