From patchwork Tue Aug 11 17:19:20 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Horia_Geant=C4=83?= X-Patchwork-Id: 6994031 X-Patchwork-Delegate: herbert@gondor.apana.org.au Return-Path: X-Original-To: patchwork-linux-crypto@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 7D91AC05AC for ; Tue, 11 Aug 2015 17:33:55 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id EB43320443 for ; Tue, 11 Aug 2015 17:33:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CA56F20426 for ; Tue, 11 Aug 2015 17:33:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751712AbbHKRdw (ORCPT ); Tue, 11 Aug 2015 13:33:52 -0400 Received: from mail-bn1bn0103.outbound.protection.outlook.com ([157.56.110.103]:29514 "EHLO na01-bn1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751672AbbHKRdu (ORCPT ); Tue, 11 Aug 2015 13:33:50 -0400 Received: from BN3PR0301CA0053.namprd03.prod.outlook.com (10.160.152.149) by BN3PR0301MB1266.namprd03.prod.outlook.com (10.161.209.146) with Microsoft SMTP Server (TLS) id 15.1.225.19; Tue, 11 Aug 2015 17:19:44 +0000 Received: from BL2FFO11FD009.protection.gbl (2a01:111:f400:7c09::160) by BN3PR0301CA0053.outlook.office365.com (2a01:111:e400:401e::21) with Microsoft SMTP Server (TLS) id 15.1.225.19 via Frontend Transport; Tue, 11 Aug 2015 17:19:44 +0000 Authentication-Results: spf=fail (sender IP is 192.88.168.50) smtp.mailfrom=freescale.com; vger.kernel.org; dkim=none (message not signed) header.d=none; Received-SPF: Fail (protection.outlook.com: domain of freescale.com does not designate 192.88.168.50 as permitted sender) receiver=protection.outlook.com; client-ip=192.88.168.50; helo=tx30smr01.am.freescale.net; Received: from tx30smr01.am.freescale.net (192.88.168.50) by BL2FFO11FD009.mail.protection.outlook.com (10.173.161.15) with Microsoft SMTP Server (TLS) id 15.1.243.9 via Frontend Transport; Tue, 11 Aug 2015 17:19:44 +0000 Received: from enigma.ea.freescale.net (enigma.ea.freescale.net [10.171.77.120]) by tx30smr01.am.freescale.net (8.14.3/8.14.0) with ESMTP id t7BHJfax008326; Tue, 11 Aug 2015 10:19:42 -0700 From: =?UTF-8?q?Horia=20Geant=C4=83?= To: Herbert Xu CC: , Subject: [PATCH] crypto: caam - fix memory corruption in ahash_final_ctx Date: Tue, 11 Aug 2015 20:19:20 +0300 Message-ID: <1439313560-14347-1-git-send-email-horia.geanta@freescale.com> X-Mailer: git-send-email 2.4.4 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-Microsoft-Exchange-Diagnostics: 1; BL2FFO11FD009; 1:9bawHgnvUsuaSqhuuHvSv3AvtoQhahcF82jxI/gTUNVbz2ljyhkWrCmSO2by0ddp6uLopJ6X+iJ0bOg9wfMjltHdNy2URWKC/r4Q5qjo8uHN223HhWXI1HHSsuw64qO0gwfnawKrpzpMxvo40WxWi8kHJKoNgnS7Yc8BD3ycqBtz4g0D2dWIDNZSSDgGr/fHtdftP1i17Rar32qbB3Dc86qkZt/DAA0M4Hqth78pOqQoyfnzboekMvjq9JmYBt+u/WS3pWD7kspV1HxcMNvw3uSl8GQ13XAHRnM6yzo5QYAkrX/4ofhIouduJrnZPVZEC9v4C68BIhCNuvjzNxLqME+BITiTKn8beaBu/uv7fjBbJifnilcw5Pb+wWnMAVef X-Forefront-Antispam-Report: CIP:192.88.168.50; CTRY:US; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(2980300002)(339900001)(3050300001)(189002)(199003)(23676002)(97736004)(5820100001)(106466001)(50986999)(50466002)(19580405001)(5001960100002)(229853001)(36756003)(68736005)(105606002)(77096005)(19580395003)(85426001)(110136002)(81156007)(6806004)(46102003)(86362001)(4001540100001)(5001860100001)(33646002)(104016003)(87936001)(189998001)(64706001)(92566002)(5001920100001)(50226001)(47776003)(5001830100001)(62966003)(77156002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB1266; H:tx30smr01.am.freescale.net; FPR:; SPF:Fail; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BN3PR0301MB1266; 2:QuASBVrNfMmgBJTZU9Dn7PIrrJlgwqEH9hsNb6RzT8lcP0HkNtyP4gpDVgqrmGRNfEiRzsDe49avqgFgRY6vjVe1y0hdBaxf1qqNs6wRluPkAGwsCTHrYR15tDVm4jKyqBR3qTPRq+aPD4iSUSf6ejpRTKE6dst7yqc/5u1Pc/w=; 3:SSD/T1q40mHV4vlSrZLh/b+jorLCSE3lJuRApvkvFpKVHatM8BThyX/e4kkh9wE4PNxP3rB8o1O80+nYzHGjbmWkJuHHVG8tRs2GED6hZr51G5ANxQOYjOrpPfg6VtRDs/WB+gaeI3xQgb4O/4mGUUN6SWTf3YVeSMPDToh0Rar5xE++NSqUEsaN5LxBeiELlFpdEf76EENWgYjvPdGR7/hThvXqyYkFEIftaKNoJ6U=; 25:aJDmnX+muvXabDBx2mVrH8BtpPDG33fUcqAms8pJ1pPiI0e+Rgj/ZuzQLbK1PJ1yvH/t0IqE5ZOCfpsKjUZyVTuv4LADshbV79AnZoUne3//KQHcZyMHQsvNK3YxJKKfp58BRCohmUNmer2p1HeJNtQ9jZjQmUaLECSCFQ8gy54daP/8q+MyhDgUkMEvCWf8LUvq97+ue2RXyk3AMpxWELQGjJ6HoHYJXnCS4vnOFFiXLuv1WwA4wTCCi7WS/RDOsHeWXxvn2mUuH9u8DRnRYQ== X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0301MB1266; X-Microsoft-Exchange-Diagnostics: 1; BN3PR0301MB1266; 20:CM7QOcpavHpDTHJNa7uZi6XBRFEJBDM9LOAcKexE18JTxHkoVZAWbTxWmSkkdtajqek0AQ8voRIRdBQmOi3ySkPtFu44C2eHPsTtAKNmsYlhbXrWWT9JwlQeRidTwuIAmfud46mR1sRakiDdjt6tvP6Rbdi90BJQJXLvlrSGEsHCOmrzStrKFdoCvpQIVg4AC5ogoA7VJ+WISwZeB3Kne6a8p1l4xkWpfTbglA/Ti9xvlp3tbCDv5Oq6YsAuvcertfnqnNKuHNNJb2feNOABnc7eCqEcJXHJwiR2r2mGDKDKIiJ+ZUJIhTFoNiMnJs2zrT2+OeA7VEIQuTu2KoE7BYOG+vqJbY9lLCiokzcTlQ8=; 4:ejw0LnuFVhf6gUqYrbg82cm2ll2T4isF6wj0tT7q1n9O1YQTKQvkyl9+IWwTOyUaoJhWJkkXhw43mxVba0yFtUHw+IGFphlp5Fws5KpME+BGTdLwGUiZps0iUfFBFmNMnY+FlUit6Gp/y7MnE4Qke9G3M9yEXAWGCJFUeS/kSLbY2pW/rR37QVFWnZSzppREIPQO4BbA5xTXcUpk19ZO8A73oRHzNuxW3HRC9uD+8sf8/65LNCV3wQyrcgkLuAr3BQzixYNZMJh1V2Fp8VeP46Jj4+HkylvOraWc6Sw22J8= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(601004)(5005006)(3002001); SRVR:BN3PR0301MB1266; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB1266; X-Forefront-PRVS: 066517B35B X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCTjNQUjAzMDFNQjEyNjY7MjM6UURPbnpXUnJIM0VuL2hmQmM0QVZ2dUxa?= =?utf-8?B?UkFoZWxKc3pTTXRyMlMzbmN1NnBtNUMwWGxDVXZ6cU14UXMvd2lkbnd0dzBw?= =?utf-8?B?VjB3TzI1VWpoM2M0WnpCTlIyMGkzS1FCT2dqMjl6RnE4dFlLQ3lLcDdJWlFD?= =?utf-8?B?Zy94OHBLRDFSdFVoNmJLanV6WFlsTEdqekpRTGNVcGYvb2x6SDhweGVYNTFU?= =?utf-8?B?NDlUKzBRa0FTNC91MmNSbGJZaktTQlBKc0xIeTZOaWZHYWNHR2c0QytTUmFF?= =?utf-8?B?ekk0YXd0cWhjWTJsUU1USmhqYkRZc0x6aWRBa3hXM0JNZ3I1My9COWJkeTcx?= =?utf-8?B?UnUzc1kzbVRNdWNFWTE3djE2dDJNc3c5ZURQa0FYSzdjcDR2VkFrREdwZWho?= =?utf-8?B?Q09XTFhzaVV6R1czR1VjWHE3MHJQVHVBWVNNN3h1d3lTRUhDZlVoVyt1MWpz?= =?utf-8?B?blQ2bXpYZ3Fud3VQY1UxaldUOWZkL1E2ZTVINzBSd0ZtdTd3MFIxVVBFVVFF?= =?utf-8?B?TGpSNVh3NWVwSUlEZ3M0ZFdueFhYMDlteisrR242ZkhEYnlqeEhaL1g4U01C?= =?utf-8?B?c2oxdDFnWG4wS2c0eUFBc3A4TGw0SG1yempzNFVMejBKdTdJRkl2NE5meE54?= =?utf-8?B?eW1DbU9sTnFrVFlyS0ZrSG85Skxaa0gzaDlTT2lsYVVScDdIQjZIMHE5MERX?= =?utf-8?B?OWNuN1ZXeSt3Qkx0YytZQmJJc2FwU1FBOUY5TGZKK0s3QlZLY1I3Y3hoWFFi?= =?utf-8?B?U29ZdE9TYlV2LzNxT1ZJelM4ZzZiZnh4U1N6dmF6UzUvT1dzNll6Q0o4TVZH?= =?utf-8?B?WjYybFlsc2FXemRDb1VPMFR1ckFqeFd3N2cvYXpNVXNsdWNnWDB5cm5hSVpR?= =?utf-8?B?YXM5d1ZURkQxY1Rlcyt2L1p6UEh0NUtCMXlaanM3TlorWEh5d3BDL3VtRXJk?= =?utf-8?B?aDNMSy9vTHVGT2dpRzR6aHQ4ODJoWXI5M1I5VDBZMGxseVB2cFBCdm8wVGxP?= =?utf-8?B?NDZMQUZMaEMweDNkMWVGR2ZLT2s2SjI0SG1WcFpxRElSVlk0MHhXVU1ESTVi?= =?utf-8?B?Ym1udXQ2UFRLRlJNSWUxdm1ieVRtVFVxV3RGeXpnS1NUWGQ3M2xSYnFVclM2?= =?utf-8?B?T3JDMmcySU1ZODRnZE9xSFpnbTdvN2N0RzBwb2QxdWZ1UnJKa0d0U1BTcEdH?= =?utf-8?B?bVBDYlJBWnJWWCtIWmQ4YTY3K0E5Zk1FSFo0RVBTN2NVSEtCQkloZU5xaUFE?= =?utf-8?B?UHRDRm5TTUp4bTJwMDVkYzM2SG9Xc294SkxvSG14KytSbVEyd0d3VUFvRUlC?= =?utf-8?B?dGswRW5za3JPa0pWcCs4RTNFd1hsbjFmaVdxZk85UlEvdXlMVkhEOXlsNTJj?= =?utf-8?B?Qi8zRUxwVTVIT2ZrT3hiN2FMamplZFVBckZDWDFjSGRwVnp3ak9wbk9CZGUz?= =?utf-8?Q?u4V8kGiZ5O+uCpOOw1oEdVhrHAICt?= X-Microsoft-Exchange-Diagnostics: 1; BN3PR0301MB1266; 5:1MPlZQQGoXtCTc/viyxAG9SzEMaVmXj/jHDdUW4tKvXZagbrYXC199T3Q5mn1VP3FMp1GCodovAv/X+V590wSq13jY6MAH2/m5pqBcTJ3sdkYalC3USoAe9T005TOj2Y4iF4KE6c+7mQndzOX4pTbQ==; 24:/TcjjMXRA0abMKG+d9fp8z9arNrSs6sKVkXsqn1q0Gw+NGesjegN97Ol3x6ZAwh79ab9xSbNP8T0IegnSvMVLD2oyCnBCf9nY+JpRlC2MM8=; 20:Pm6GQh2OG/HPv1ulpqlNbTtsqjTsUCQJCarrnqcMwCjLObR7ag1AyN6vyXpCnYkq+TTUP3s8esmSzgV/Al+mEw== SpamDiagnosticOutput: 1:23 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: freescale.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Aug 2015 17:19:44.2565 (UTC) X-MS-Exchange-CrossTenant-Id: 710a03f5-10f6-4d38-9ff4-a80b81da590d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=710a03f5-10f6-4d38-9ff4-a80b81da590d; Ip=[192.88.168.50]; Helo=[tx30smr01.am.freescale.net] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB1266 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When doing pointer operation for accessing the HW S/G table, a value representing number of entries (and not number of bytes) must be used. Cc: # 3.6+ Fixes: 045e36780f115 ("crypto: caam - ahash hmac support") Signed-off-by: Horia Geant? --- drivers/crypto/caam/caamhash.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c index bb0935a3817c..6c142617f8cc 100644 --- a/drivers/crypto/caam/caamhash.c +++ b/drivers/crypto/caam/caamhash.c @@ -909,13 +909,14 @@ static int ahash_final_ctx(struct ahash_request *req) state->buflen_1; u32 *sh_desc = ctx->sh_desc_fin, *desc; dma_addr_t ptr = ctx->sh_desc_fin_dma; - int sec4_sg_bytes; + int sec4_sg_bytes, sec4_sg_src_index; int digestsize = crypto_ahash_digestsize(ahash); struct ahash_edesc *edesc; int ret = 0; int sh_len; - sec4_sg_bytes = (1 + (buflen ? 1 : 0)) * sizeof(struct sec4_sg_entry); + sec4_sg_src_index = 1 + (buflen ? 1 : 0); + sec4_sg_bytes = sec4_sg_src_index * sizeof(struct sec4_sg_entry); /* allocate space for base edesc and hw desc commands, link tables */ edesc = kzalloc(sizeof(*edesc) + DESC_JOB_IO_LEN + sec4_sg_bytes, @@ -942,7 +943,7 @@ static int ahash_final_ctx(struct ahash_request *req) state->buf_dma = try_buf_map_to_sec4_sg(jrdev, edesc->sec4_sg + 1, buf, state->buf_dma, buflen, last_buflen); - (edesc->sec4_sg + sec4_sg_bytes - 1)->len |= SEC4_SG_LEN_FIN; + (edesc->sec4_sg + sec4_sg_src_index - 1)->len |= SEC4_SG_LEN_FIN; edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg, sec4_sg_bytes, DMA_TO_DEVICE);