On Fri, Jan 16, 2009 at 10:37:02AM +0800, Huang Ying wrote: > > But after checking blkcipher_walk_done() in 2.6.28, If input argument > err != 0 and walk->flags & BLKCIPHER_WALK_SLOW != 0, when > blkcipher_walk_done() return non-zero, walk->nbytes != 0. So I think it > is a little fragile to use walk->nbytes == 0 indicate error. Right, that's a bug. Although this case shouldn't occur unless wer have a buggy algorithm (that's why it's a WARN_ON). But as we're handling it anyway, we should ensure that the result is sane. crypt: blkcipher - Fix WARN_ON handling in walk_done When we get left-over bits from a slow walk, it means that the underlying cipher has gone troppo. However, as we're handling that case we should ensure that the caller terminates the walk. This patch does this by setting walk->nbytes to zero. Reported-by: Huang Ying <ying.huang@xxxxxxxxx> Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c index 4a7e65c..d70a41c 100644 --- a/crypto/blkcipher.c +++ b/crypto/blkcipher.c @@ -124,6 +124,7 @@ int blkcipher_walk_done(struct blkcipher_desc *desc, scatterwalk_done(&walk->in, 0, nbytes); scatterwalk_done(&walk->out, 1, nbytes); +err: walk->total = nbytes; walk->nbytes = nbytes; @@ -132,7 +133,6 @@ int blkcipher_walk_done(struct blkcipher_desc *desc, return blkcipher_walk_next(desc, walk); } -err: if (walk->iv != desc->info) memcpy(desc->info, walk->iv, crypto_blkcipher_ivsize(tfm)); if (walk->buffer != walk->page) Thanks, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
