mirror of
https://github.com/torvalds/linux.git
synced 2024-12-29 14:21:47 +00:00
crypto: algif_skcipher - only call put_page on referenced and used pages
For asynchronous operation, SGs are allocated without a page mapped to them or with a page that is not used (ref-counted). If the SGL is freed, the code must only call put_page for an SG if there was a page assigned and ref-counted in the first place. This fixes a kernel crash when using io_submit with more than one iocb using the sendmsg and sendpage (vmsplice/splice) interface. Cc: <stable@vger.kernel.org> Signed-off-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
parent
549f64153c
commit
445a582738
@ -87,8 +87,13 @@ static void skcipher_free_async_sgls(struct skcipher_async_req *sreq)
|
||||
}
|
||||
sgl = sreq->tsg;
|
||||
n = sg_nents(sgl);
|
||||
for_each_sg(sgl, sg, n, i)
|
||||
put_page(sg_page(sg));
|
||||
for_each_sg(sgl, sg, n, i) {
|
||||
struct page *page = sg_page(sg);
|
||||
|
||||
/* some SGs may not have a page mapped */
|
||||
if (page && page_ref_count(page))
|
||||
put_page(page);
|
||||
}
|
||||
|
||||
kfree(sreq->tsg);
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user