crypto: algif_skcipher - Fixed overflow when sndbuf is page alignedherbert

Hi:

Just noticed that algif_skcipher fails to apply the sk_sndbuf limit
correctly unless it is a multiple of PAGE_SIZE.  What happens is
that the merge path will exceed sk_sndbuf causing the subsequent
limit comparison to fail as it tries to do an unsigned comparison
with a negative value.

This patch fixes the problem.

commit 0f6bb83cb12e4617e696ffa566f3fc6c092686e2
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Tue Nov 30 16:49:02 2010 +0800

    crypto: algif_skcipher - Fixed overflow when sndbuf is page aligned

    When sk_sndbuf is not a multiple of PAGE_SIZE, the limit tests
    in sendmsg fail as the limit variable becomes negative and we're
    using an unsigned comparison.

    The same thing can happen if sk_sndbuf is lowered after a sendmsg
    call.

    This patch fixes this by always taking the signed maximum of limit
    and 0 before we perform the comparison.

    It also rounds the value of sk_sndbuf down to a multiple of PAGE_SIZE
    so that we don't end up allocating a page only to use a small number
    of bytes in it because we're bound by sk_sndbuf.

    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

0 files changed, 0 insertions, 0 deletions