On 09/09/2015 09:56 AM, Stephan Mueller wrote: >>> But in the rsa.c enc/dec/verify/sign functions, there should be such check, >>> >> I would guess. >> > >> >There is see line 419: >> >return pkey->n ? mpi_get_size(pkey->n) : -EINVAL; > I feel we are not talking about the same issue. I refer to your patch in > rsa.c: > > + int src_len = sg_len(req->src), dst_len = sg_len(req->dst); > > ===> can be negative according to your statement > > ... > > + void *ptr = kmalloc(dst_len, GFP_KERNEL); > > ===> with a negative number, I guess we have a problem here. Yes, sorry, you are right. sg_len() will only return positive numbers or zero. rsa.c checks it in all four operations: if (unlikely(!pkey->n || !pkey->d || !src_len)) -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
