On 11/17/2016 06:07 AM, Herbert Xu wrote:
> On Wed, Nov 16, 2016 at 11:17:33AM -0800, Mat Martineau wrote:
>>
>> Herbert -
>>
>> Following commit 493b2ed3f7603a15ff738553384d5a4510ffeb95, there is a NULL
>> dereference crash in algif_hash when recv() is called twice like this:
>>
>> send(sk, data,
On Wed, Nov 16, 2016 at 11:17:33AM -0800, Mat Martineau wrote:
>
> Herbert -
>
> Following commit 493b2ed3f7603a15ff738553384d5a4510ffeb95, there is a NULL
> dereference crash in algif_hash when recv() is called twice like this:
>
> send(sk, data, len, MSG_MORE);
> recv(sk, hash1, len, 0);
> rec
Herbert,
On Thu, 17 Nov 2016, Herbert Xu wrote:
On Wed, Nov 16, 2016 at 11:17:33AM -0800, Mat Martineau wrote:
Herbert -
Following commit 493b2ed3f7603a15ff738553384d5a4510ffeb95, there is a NULL
dereference crash in algif_hash when recv() is called twice like this:
send(sk, data, len, MSG
Herbert -
Following commit 493b2ed3f7603a15ff738553384d5a4510ffeb95, there is a NULL
dereference crash in algif_hash when recv() is called twice like this:
send(sk, data, len, MSG_MORE);
recv(sk, hash1, len, 0);
recv(sk, hash2, len, 0);
In 4.8 and earlier, the two recvs return identical data
