crypto: algif_skcipher - Load TX SG list after waiting

commit 4f0414e54e4d1893c6f08260693f8ef84c929293 upstream.

We need to load the TX SG list in sendmsg(2) after waiting for
incoming data, not before.

[connoro@google.com: backport to 3.18, where the relevant logic is
located in skcipher_recvmsg() rather than skcipher_recvmsg_sync()]

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Connor O'Brien <connoro@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index fd1967ecc92895399792b49bf9d313884dc42e3c..110970be07165c1c5d3c0feb87b83e7271c5b09c 100644 (file)
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -448,13 +448,6 @@ static int skcipher_recvmsg(struct kiocb *unused, struct socket *sock,
                char __user *from = iov->iov_base;
 
                while (seglen) {
-                       sgl = list_first_entry(&ctx->tsgl,
-                                              struct skcipher_sg_list, list);
-                       sg = sgl->sg;
-
-                       while (!sg->length)
-                               sg++;
-
                        used = ctx->used;
                        if (!used) {
                                err = skcipher_wait_for_data(sk, flags);
@@ -476,6 +469,13 @@ static int skcipher_recvmsg(struct kiocb *unused, struct socket *sock,
                        if (!used)
                                goto free;
 
+                       sgl = list_first_entry(&ctx->tsgl,
+                                              struct skcipher_sg_list, list);
+                       sg = sgl->sg;
+
+                       while (!sg->length)
+                               sg++;
+
                        ablkcipher_request_set_crypt(&ctx->req, sg,
                                                     ctx->rsgl.sg, used,
                                                     ctx->iv);