crypto: algif_aead - fix AIO handling of zero buffer

Handle the case when the caller provided a zero buffer to
sendmsg/sendpage. Such scenario is legal for AEAD ciphers when no
plaintext / ciphertext and no AAD is provided and the caller only
requests the generation of the tag value.

Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 80a0f1a7855181930afa0a545f5bf79584141e5c..6e95137015336d53acd9a2e3a0ebb30b40dd4ab3 100644 (file)
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -448,12 +448,13 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
        used -= ctx->aead_assoclen + (ctx->enc ? as : 0);
 
        /* take over all tx sgls from ctx */
-       areq->tsgl = sock_kmalloc(sk, sizeof(*areq->tsgl) * sgl->cur,
+       areq->tsgl = sock_kmalloc(sk,
+                                 sizeof(*areq->tsgl) * max_t(u32, sgl->cur, 1),
                                  GFP_KERNEL);
        if (unlikely(!areq->tsgl))
                goto free;
 
-       sg_init_table(areq->tsgl, sgl->cur);
+       sg_init_table(areq->tsgl, max_t(u32, sgl->cur, 1));
        for (i = 0; i < sgl->cur; i++)
                sg_set_page(&areq->tsgl[i], sg_page(&sgl->sg[i]),
                            sgl->sg[i].length, sgl->sg[i].offset);