diff options
| author | Horia Geant? <horia.geanta@freescale.com> | 2015-08-11 17:19:20 (GMT) |
|---|---|---|
| committer | Alex Porosanu <alexandru.porosanu@freescale.com> | 2015-11-03 09:49:46 (GMT) |
| commit | 4fd8cac059bd7eb2748fd1fbbf2baaa65b3b8a08 (patch) | |
| tree | d4f52ca432a51fca5c2e05331b48d7fa4ef7c2fc | |
| parent | 16d4087fef605b53c187e6f059747c8c31b93df1 (diff) | |
| download | linux-fsl-qoriq-4fd8cac059bd7eb2748fd1fbbf2baaa65b3b8a08.tar.xz | |
crypto: caam - fix memory corruption in ahash_final_ctx
When doing pointer operation for accessing the HW S/G table,
a value representing number of entries (and not number of bytes)
must be used.
Cc: <stable@vger.kernel.org> # 3.6+
Fixes: 045e36780f115 ("crypto: caam - ahash hmac support")
Signed-off-by: Horia Geant? <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
(cherry picked from commit b310c178e6d897f82abb9da3af1cd7c02b09f592)
| -rw-r--r-- | drivers/crypto/caam/caamhash.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c index 8b22117..9a3c8dd 100644 --- a/drivers/crypto/caam/caamhash.c +++ b/drivers/crypto/caam/caamhash.c @@ -909,13 +909,14 @@ static int ahash_final_ctx(struct ahash_request *req) state->buflen_1; u32 *sh_desc = ctx->sh_desc_fin, *desc; dma_addr_t ptr = ctx->sh_desc_fin_dma; - int sec4_sg_bytes; + int sec4_sg_bytes, sec4_sg_src_index; int digestsize = crypto_ahash_digestsize(ahash); struct ahash_edesc *edesc; int ret = 0; int sh_len; - sec4_sg_bytes = (1 + (buflen ? 1 : 0)) * sizeof(struct sec4_sg_entry); + sec4_sg_src_index = 1 + (buflen ? 1 : 0); + sec4_sg_bytes = sec4_sg_src_index * sizeof(struct sec4_sg_entry); /* allocate space for base edesc and hw desc commands, link tables */ edesc = kmalloc(sizeof(struct ahash_edesc) + DESC_JOB_IO_LEN + @@ -942,7 +943,7 @@ static int ahash_final_ctx(struct ahash_request *req) state->buf_dma = try_buf_map_to_sec4_sg(jrdev, edesc->sec4_sg + 1, buf, state->buf_dma, buflen, last_buflen); - (edesc->sec4_sg + sec4_sg_bytes - 1)->len |= SEC4_SG_LEN_FIN; + (edesc->sec4_sg + sec4_sg_src_index - 1)->len |= SEC4_SG_LEN_FIN; edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg, sec4_sg_bytes, DMA_TO_DEVICE); |