Commit c4bfed85 authored by Stephan Mueller's avatar Stephan Mueller Committed by Greg Kroah-Hartman
Browse files

crypto: af_alg - Initialize sg_num_bytes in error code path 



commit 2546da99 upstream.

The RX SGL in processing is already registered with the RX SGL tracking
list to support proper cleanup. The cleanup code path uses the
sg_num_bytes variable which must therefore be always initialized, even
in the error code path.

Signed-off-by: default avatarStephan Mueller <smueller@chronox.de>
Reported-by: default avatar <syzbot+9c251bdd09f83b92ba95@syzkaller.appspotmail.com>
#syz test: https://github.com/google/kmsan.git

 master
CC: <stable@vger.kernel.org> #4.14
Fixes: e870456d ("crypto: algif_skcipher - overhaul memory management")
Fixes: d887c52d ("crypto: algif_aead - overhaul memory management")
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 16b3ae12

crypto/af_alg.c

+3 −1
Original line number Diff line number Diff line
@@ -1183,8 +1183,10 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, 


		/* make one iovec available as scatterlist */

		err = af_alg_make_sg(&rsgl->sgl, &msg->msg_iter, seglen);

		if (err < 0)

		if (err < 0) {

			rsgl->sg_num_bytes = 0;

			return err;

		}



		/* chain the new scatterlist with previous one */

		if (areq->last_rsgl)