This is a note to let you know that I've just added the patch titled crypto: algif_skcipher - sendmsg SG marking is off by one to the 4.3-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: crypto-algif_skcipher-sendmsg-sg-marking-is-off-by-one.patch and it can be found in the queue-4.3 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 202736d99b7f29279db9da61587f11a08a04a9c6 Mon Sep 17 00:00:00 2001 From: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> Date: Tue, 19 Jan 2016 21:23:57 +0800 Subject: crypto: algif_skcipher - sendmsg SG marking is off by one From: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> commit 202736d99b7f29279db9da61587f11a08a04a9c6 upstream. We mark the end of the SG list in sendmsg and sendpage and unmark it on the next send call. Unfortunately the unmarking in sendmsg is off-by-one, leading to an SG list that is too short. Fixes: 0f477b655a52 ("crypto: algif - Mark sgl end at the end of data") Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- crypto/algif_skcipher.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/crypto/algif_skcipher.c +++ b/crypto/algif_skcipher.c @@ -392,7 +392,8 @@ static int skcipher_sendmsg(struct socke sgl = list_entry(ctx->tsgl.prev, struct skcipher_sg_list, list); sg = sgl->sg; - sg_unmark_end(sg + sgl->cur); + if (sgl->cur) + sg_unmark_end(sg + sgl->cur - 1); do { i = sgl->cur; plen = min_t(int, len, PAGE_SIZE); Patches currently in stable-queue which might be from herbert@xxxxxxxxxxxxxxxxxxx are queue-4.3/crypto-fix-test-vector-for-rsa.patch queue-4.3/crypto-algif_skcipher-use-new-skcipher-interface.patch queue-4.3/crypto-af_alg-disallow-bind-setkey-...-after-accept-2.patch queue-4.3/crypto-crc32c-fix-crc32c-soft-dependency.patch queue-4.3/crypto-af_alg-forbid-bind-2-when-nokey-child-sockets-are-present.patch queue-4.3/crypto-crc32c-pclmul-use-.rodata-instead-of-.rotata.patch queue-4.3/crypto-caam-fix-non-block-aligned-hash-calculation.patch queue-4.3/crypto-nx-fix-timing-leak-in-gcm-and-ccm-decryption.patch queue-4.3/crypto-skcipher-copy-iv-from-desc-even-for-0-len-walks.patch queue-4.3/crypto-algif_hash-fix-race-condition-in-hash_check_key.patch queue-4.3/crypto-skcipher-add-crypto_skcipher_has_setkey.patch queue-4.3/crypto-chacha20-ssse3-align-stack-pointer-to-64-bytes.patch queue-4.3/crypto-algif_skcipher-add-key-check-exception-for-cipher_null.patch queue-4.3/crypto-algif_hash-remove-custom-release-parent-function.patch queue-4.3/crypto-algif_skcipher-load-tx-sg-list-after-waiting.patch queue-4.3/crypto-algif_skcipher-require-setkey-before-accept-2.patch queue-4.3/crypto-algif_skcipher-add-nokey-compatibility-path.patch queue-4.3/crypto-shash-fix-has_key-setting.patch queue-4.3/crypto-algif_skcipher-remove-custom-release-parent-function.patch queue-4.3/crypto-af_alg-allow-af_af_alg_release_parent-to-be-called-on-nokey-path.patch queue-4.3/crypto-hash-add-crypto_ahash_has_setkey.patch queue-4.3/crypto-af_alg-add-nokey-compatibility-path.patch queue-4.3/crypto-sun4i-ss-add-missing-statesize.patch queue-4.3/crypto-algif_hash-require-setkey-before-accept-2.patch queue-4.3/crypto-algif_skcipher-sendmsg-sg-marking-is-off-by-one.patch queue-4.3/crypto-qat-don-t-use-userspace-pointer.patch queue-4.3/crypto-talitos-fix-timing-leak-in-esp-icv-verification.patch queue-4.3/crypto-algif_hash-only-export-and-import-on-sockets-with-data.patch queue-4.3/crypto-algif_skcipher-fix-race-condition-in-skcipher_check_key.patch queue-4.3/crypto-caam-make-write-transactions-bufferable-on-ppc-platforms.patch queue-4.3/crypto-af_alg-fix-socket-double-free-when-accept-fails.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html