From 0de60bc90aaadc0fbde2ec755d6b37775f7e124e Mon Sep 17 00:00:00 2001
From: Cristian Stoica <cristian.stoica@freescale.com>
Date: Wed, 24 Sep 2014 16:06:47 +0300
Subject: crypto: caam: fix sg_count searching out of bound

Signed-off-by: Cristian Stoica <cristian.stoica@freescale.com>
Change-Id: I0acac8a5fb22a0095ec1c347e4a100a277ac788f
Reviewed-on: http://git.am.freescale.net:8181/19810
Tested-by: Review Code-CDREVIEW <CDREVIEW@freescale.com>
Reviewed-by: Mircea Pop <mircea.pop@freescale.com>
Reviewed-by: Matthew Weigel <Matthew.Weigel@freescale.com>

diff --git a/drivers/crypto/caam/sg_sw_qm.h b/drivers/crypto/caam/sg_sw_qm.h
index 2778dbf..778e4be 100644
--- a/drivers/crypto/caam/sg_sw_qm.h
+++ b/drivers/crypto/caam/sg_sw_qm.h
@@ -55,7 +55,7 @@ static inline struct qm_sg_entry *
 sg_to_qm_sg(struct scatterlist *sg, int sg_count,
 	    struct qm_sg_entry *qm_sg_ptr, u16 offset)
 {
-	while (sg_count) {
+	while (sg_count && sg) {
 		dma_to_qm_sg_one(qm_sg_ptr, sg_dma_address(sg),
 				 sg_dma_len(sg), offset);
 		qm_sg_ptr++;
diff --git a/drivers/crypto/caam/sg_sw_sec4.h b/drivers/crypto/caam/sg_sw_sec4.h
index 62bdf16..0dca376 100644
--- a/drivers/crypto/caam/sg_sw_sec4.h
+++ b/drivers/crypto/caam/sg_sw_sec4.h
@@ -33,7 +33,10 @@ static inline struct sec4_sg_entry *
 sg_to_sec4_sg(struct scatterlist *sg, int sg_count,
 	      struct sec4_sg_entry *sec4_sg_ptr, u16 offset)
 {
-	while (sg_count) {
+	if (!sg)
+		return NULL;
+
+	while (sg_count && sg) {
 		dma_to_sec4_sg_one(sec4_sg_ptr, sg_dma_address(sg),
 				   sg_dma_len(sg), offset);
 		sec4_sg_ptr++;
@@ -51,6 +54,8 @@ static inline void sg_to_sec4_sg_last(struct scatterlist *sg, int sg_count,
 				      struct sec4_sg_entry *sec4_sg_ptr,
 				      u16 offset)
 {
+	if (!sg)
+		return;
 	sec4_sg_ptr = sg_to_sec4_sg(sg, sg_count, sec4_sg_ptr, offset);
 	sec4_sg_ptr->len |= SEC4_SG_LEN_FIN;
 }
@@ -89,9 +94,12 @@ static int dma_map_sg_chained(struct device *dev, struct scatterlist *sg,
 			      unsigned int nents, enum dma_data_direction dir,
 			      bool chained)
 {
+	if (!sg || !nents)
+		return 0;
+
 	if (unlikely(chained)) {
 		int i;
-		for (i = 0; i < nents; i++) {
+		for (i = 0; i < nents && sg; i++) {
 			dma_map_sg(dev, sg, 1, dir);
 			sg = scatterwalk_sg_next(sg);
 		}
@@ -105,9 +113,12 @@ static int dma_unmap_sg_chained(struct device *dev, struct scatterlist *sg,
 				unsigned int nents, enum dma_data_direction dir,
 				bool chained)
 {
+	if (!sg || !nents)
+		return;
+
 	if (unlikely(chained)) {
 		int i;
-		for (i = 0; i < nents; i++) {
+		for (i = 0; i < nents && sg; i++) {
 			dma_unmap_sg(dev, sg, 1, dir);
 			sg = scatterwalk_sg_next(sg);
 		}
-- 
cgit v0.10.2