crypto: af_alg - update correct dst SGL entry

When two adjacent TX SGL are processed and parts of both TX SGLs
are pulled into the per-request TX SGL, the wrong per-request
TX SGL entries were updated.

This fixes a NULL pointer dereference when a cipher implementation walks
the TX SGL where some of the SGL entries were NULL.

Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory...")
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index ffa9f4ccd9b455ef36c48d3ba57d4256574cd450..337cf382718ee3cd81ffe3cdc480052a6f634798 100644 (file)
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -619,14 +619,14 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
        struct af_alg_ctx *ctx = ask->private;
        struct af_alg_tsgl *sgl;
        struct scatterlist *sg;
-       unsigned int i, j;
+       unsigned int i, j = 0;
 
        while (!list_empty(&ctx->tsgl_list)) {
                sgl = list_first_entry(&ctx->tsgl_list, struct af_alg_tsgl,
                                       list);
                sg = sgl->sg;
 
-               for (i = 0, j = 0; i < sgl->cur; i++) {
+               for (i = 0; i < sgl->cur; i++) {
                        size_t plen = min_t(size_t, used, sg[i].length);
                        struct page *page = sg_page(sg + i);