--- /dev/null
+From 4f0414e54e4d1893c6f08260693f8ef84c929293 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Mon, 18 Jan 2016 18:46:10 +0800
+Subject: crypto: algif_skcipher - Load TX SG list after waiting
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+commit 4f0414e54e4d1893c6f08260693f8ef84c929293 upstream.
+
+We need to load the TX SG list in sendmsg(2) after waiting for
+incoming data, not before.
+
+[connoro@google.com: backport to 3.18, where the relevant logic is
+located in skcipher_recvmsg() rather than skcipher_recvmsg_sync()]
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Tested-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Connor O'Brien <connoro@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/algif_skcipher.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -448,13 +448,6 @@ static int skcipher_recvmsg(struct kiocb
+ char __user *from = iov->iov_base;
+
+ while (seglen) {
+- sgl = list_first_entry(&ctx->tsgl,
+- struct skcipher_sg_list, list);
+- sg = sgl->sg;
+-
+- while (!sg->length)
+- sg++;
+-
+ used = ctx->used;
+ if (!used) {
+ err = skcipher_wait_for_data(sk, flags);
+@@ -476,6 +469,13 @@ static int skcipher_recvmsg(struct kiocb
+ if (!used)
+ goto free;
+
++ sgl = list_first_entry(&ctx->tsgl,
++ struct skcipher_sg_list, list);
++ sg = sgl->sg;
++
++ while (!sg->length)
++ sg++;
++
+ ablkcipher_request_set_crypt(&ctx->req, sg,
+ ctx->rsgl.sg, used,
+ ctx->iv);