diff options
| author | Horia Geanta <horia.geanta@freescale.com> | 2015-05-08 15:29:37 (GMT) |
|---|---|---|
| committer | Honghua Yin <Hong-Hua.Yin@freescale.com> | 2015-05-13 08:02:46 (GMT) |
| commit | 8aa7fc35dabf261899525f3da29ea21a111b3707 (patch) | |
| tree | 29befeb342765913d11a0168e5eeb540593f9071 /drivers | |
| parent | e4fd75bc70c7dcb6007c50e9ac68978726d5da25 (diff) | |
| download | linux-fsl-qoriq-8aa7fc35dabf261899525f3da29ea21a111b3707.tar.xz | |
crypto: talitos - avoid out of bound scatterlist iterator
Check return value of scatterlist_sg_next(), i.e. don't rely solely
on number of bytes to be processed or number of scatterlist entries.
Change-Id: I6c10ed15e9a456b87828ebb21cc1121c7041be7d
Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
Reviewed-on: http://git.am.freescale.net:8181/36122
Tested-by: Review Code-CDREVIEW <CDREVIEW@freescale.com>
Reviewed-by: Tudor-Dan Ambarus <tudor.ambarus@freescale.com>
Reviewed-by: Honghua Yin <Hong-Hua.Yin@freescale.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/crypto/talitos.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c index c7a1368..1edb686 100644 --- a/drivers/crypto/talitos.c +++ b/drivers/crypto/talitos.c @@ -1298,7 +1298,7 @@ static int sg_to_link_tbl(struct scatterlist *sg, int sg_count, { int n_sg = sg_count; - while (n_sg--) { + while (sg && n_sg--) { to_talitos_ptr(link_tbl_ptr, sg_dma_address(sg)); link_tbl_ptr->len = cpu_to_be16(sg_dma_len(sg)); link_tbl_ptr->j_extent = 0; @@ -1486,7 +1486,7 @@ static int sg_count(struct scatterlist *sg_list, int nbytes, bool *chained) int sg_nents = 0; *chained = false; - while (nbytes > 0) { + while (nbytes > 0 && sg) { sg_nents++; nbytes -= sg->length; if (!sg_is_last(sg) && (sg + 1)->length == 0) |