In skcipher_accept_parent_nokey() the whole af_alg_ctx structure is cleared by memset() after allocation, so add such memset() also to aead_accept_parent_nokey() so that the new "init" field is also initialized to zero. Without that the initial ctx->init checks might randomly return true and cause errors. While there, also remove the redundant zero assignments in both functions. Found via libkcapi testsuite.
Unified · Split
| @@ -558,12 +558,6 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk) · 557 unmodified lines | |||
| 558 | 558 | ||
| 559 | INIT_LIST_HEAD(&ctx->tsgl_list); | 559 | INIT_LIST_HEAD(&ctx->tsgl_list); |
| 560 | ctx->len = len; | 560 | ctx->len = len; |
| 561 | ctx->used = 0; | ||
| 562 | atomic_set(&ctx->rcvused, 0); | ||
| 563 | ctx->more = 0; | ||
| 564 | ctx->merge = 0; | ||
| 565 | ctx->enc = 0; | ||
| 566 | ctx->aead_assoclen = 0; | ||
| 567 | crypto_init_wait(&ctx->wait); | 561 | crypto_init_wait(&ctx->wait); |
| 568 | 562 | ||
| 569 | ask->private = ctx; | 563 | ask->private = ctx; |
| @@ -333,6 +333,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) · 332 unmodified lines | |||
| 333 | ctx = sock_kmalloc(sk, len, GFP_KERNEL); | 333 | ctx = sock_kmalloc(sk, len, GFP_KERNEL); |
| 334 | if (!ctx) | 334 | if (!ctx) |
| 335 | return -ENOMEM; | 335 | return -ENOMEM; |
| 336 | memset(ctx, 0, len); | ||
| 336 | 337 | ||
| 337 | ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm), | 338 | ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm), |
| 338 | GFP_KERNEL); | 339 | GFP_KERNEL); |
| @@ -340,16 +341,10 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) · 1 unmodified line | |||
| 340 | sock_kfree_s(sk, ctx, len); | 341 | sock_kfree_s(sk, ctx, len); |
| 341 | return -ENOMEM; | 342 | return -ENOMEM; |
| 342 | } | 343 | } |
| 343 | |||
| 344 | memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm)); | 344 | memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm)); |
| 345 | 345 | ||
| 346 | INIT_LIST_HEAD(&ctx->tsgl_list); | 346 | INIT_LIST_HEAD(&ctx->tsgl_list); |
| 347 | ctx->len = len; | 347 | ctx->len = len; |
| 348 | ctx->used = 0; | ||
| 349 | atomic_set(&ctx->rcvused, 0); | ||
| 350 | ctx->more = 0; | ||
| 351 | ctx->merge = 0; | ||
| 352 | ctx->enc = 0; | ||
| 353 | crypto_init_wait(&ctx->wait); | 348 | crypto_init_wait(&ctx->wait); |
| 354 | 349 | ||
| 355 | ask->private = ctx; | 350 | ask->private = ctx; |