Commit 8ad83d64 authored by Roel Kluin's avatar Roel Kluin Committed by james toy

size_t desc_len cannot be less than 0, test before the subtraction.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Cc: Mikael Starvik <starvik@axis.com>
Cc: Jesper Nilsson <jesper.nilsson@axis.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent b6b6d879
...@@ -628,9 +628,9 @@ static int create_output_descriptors(struct cryptocop_operation *operation, int ...@@ -628,9 +628,9 @@ static int create_output_descriptors(struct cryptocop_operation *operation, int
cdesc->dma_descr->buf = (char*)virt_to_phys(operation->tfrm_op.indata[*iniov_ix].iov_base + *iniov_offset); cdesc->dma_descr->buf = (char*)virt_to_phys(operation->tfrm_op.indata[*iniov_ix].iov_base + *iniov_offset);
cdesc->dma_descr->after = cdesc->dma_descr->buf + dlength; cdesc->dma_descr->after = cdesc->dma_descr->buf + dlength;
assert(desc_len >= dlength);
desc_len -= dlength; desc_len -= dlength;
*iniov_offset += dlength; *iniov_offset += dlength;
assert(desc_len >= 0);
if (*iniov_offset >= operation->tfrm_op.indata[*iniov_ix].iov_len) { if (*iniov_offset >= operation->tfrm_op.indata[*iniov_ix].iov_len) {
*iniov_offset = 0; *iniov_offset = 0;
++(*iniov_ix); ++(*iniov_ix);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment