From patchwork Wed Nov 4 20:13:34 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Corentin Labbe X-Patchwork-Id: 7553141 X-Patchwork-Delegate: herbert@gondor.apana.org.au Return-Path: X-Original-To: patchwork-linux-crypto@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 840CF9F36A for ; Wed, 4 Nov 2015 20:18:12 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A688F2053F for ; Wed, 4 Nov 2015 20:18:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A2BBC20532 for ; Wed, 4 Nov 2015 20:18:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1030583AbbKDURv (ORCPT ); Wed, 4 Nov 2015 15:17:51 -0500 Received: from mail-wm0-f47.google.com ([74.125.82.47]:35835 "EHLO mail-wm0-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965161AbbKDUO0 (ORCPT ); Wed, 4 Nov 2015 15:14:26 -0500 Received: by wmll128 with SMTP id l128so124009933wml.0; Wed, 04 Nov 2015 12:14:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=drW2T35X8ifaAQ/Yv29CB9YndZj5RFRkxc/vqzOhn5I=; b=k5Ff5NrhKqlYVySZs81QE4zKkvlu4qWU2jsHAPPxDYlA9iRf1zpdNVQ9J1jHrcKDuO KRUdyKX5Eo6Lbh8c4K2ECL+AAth+VLobQbGHo7kbY9kK68bSKAC0pMc4Gu1V7iQqL/fa hgjI3n3LtL9sGqa6PtxrHTuw46C76AjLJIUN3gGivcylbKHEOGYwp8lpJeXszMAN7Ngs LZ+BLro0F/ZhPKTv6CgajC/ixfs2eI4Y2f15EKaNhin3wsbgyEOszYBlEv0mCoZtzrve hP2D0DPSos18sljnrdgf9kdaaI6K3GEsBLr4WS7zu0B/5USrnm1nqrFZpmjk2ylMbjBw AYOA== X-Received: by 10.28.138.148 with SMTP id m142mr5271766wmd.79.1446668065303; Wed, 04 Nov 2015 12:14:25 -0800 (PST) Received: from Red.local (ANice-651-1-289-62.w83-201.abo.wanadoo.fr. [83.201.177.62]) by smtp.googlemail.com with ESMTPSA id 77sm4702051wml.20.2015.11.04.12.14.24 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 04 Nov 2015 12:14:24 -0800 (PST) From: LABBE Corentin To: davem@davemloft.net, herbert@gondor.apana.org.au Cc: LABBE Corentin , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/7] crypto: talitos: check return value of sg_nents_for_len Date: Wed, 4 Nov 2015 21:13:34 +0100 Message-Id: <1446668045-8620-2-git-send-email-clabbe.montjoie@gmail.com> X-Mailer: git-send-email 2.4.10 In-Reply-To: <1446668045-8620-1-git-send-email-clabbe.montjoie@gmail.com> References: <1446668045-8620-1-git-send-email-clabbe.montjoie@gmail.com> Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The sg_nents_for_len() function could fail, this patch add a check for its return value. Signed-off-by: LABBE Corentin --- drivers/crypto/talitos.c | 41 ++++++++++++++++++++++++++++++++++------- 1 file changed, 34 insertions(+), 7 deletions(-) diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c index 46f531e..898ab6c 100644 --- a/drivers/crypto/talitos.c +++ b/drivers/crypto/talitos.c @@ -1216,6 +1216,7 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, struct talitos_private *priv = dev_get_drvdata(dev); bool is_sec1 = has_ftr_sec1(priv); int max_len = is_sec1 ? TALITOS1_MAX_DATA_LEN : TALITOS2_MAX_DATA_LEN; + void *err; if (cryptlen + authsize > max_len) { dev_err(dev, "length exceeds h/w max limit\n"); @@ -1228,14 +1229,29 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, if (!dst || dst == src) { src_nents = sg_nents_for_len(src, assoclen + cryptlen + authsize); + if (src_nents < 0) { + dev_err(dev, "Invalid number of src SG.\n"); + err = ERR_PTR(-EINVAL); + goto error_sg; + } src_nents = (src_nents == 1) ? 0 : src_nents; dst_nents = dst ? src_nents : 0; } else { /* dst && dst != src*/ src_nents = sg_nents_for_len(src, assoclen + cryptlen + (encrypt ? 0 : authsize)); + if (src_nents < 0) { + dev_err(dev, "Invalid number of src SG.\n"); + err = ERR_PTR(-EINVAL); + goto error_sg; + } src_nents = (src_nents == 1) ? 0 : src_nents; dst_nents = sg_nents_for_len(dst, assoclen + cryptlen + (encrypt ? authsize : 0)); + if (dst_nents < 0) { + dev_err(dev, "Invalid number of dst SG.\n"); + err = ERR_PTR(-EINVAL); + goto error_sg; + } dst_nents = (dst_nents == 1) ? 0 : dst_nents; } @@ -1260,11 +1276,9 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, edesc = kmalloc(alloc_len, GFP_DMA | flags); if (!edesc) { - if (iv_dma) - dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE); - dev_err(dev, "could not allocate edescriptor\n"); - return ERR_PTR(-ENOMEM); + err = ERR_PTR(-ENOMEM); + goto error_sg; } edesc->src_nents = src_nents; @@ -1277,6 +1291,10 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev, DMA_BIDIRECTIONAL); return edesc; +error_sg: + if (iv_dma) + dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE); + return err; } static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv, @@ -1830,11 +1848,16 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes) unsigned int nbytes_to_hash; unsigned int to_hash_later; unsigned int nsg; + int nents; if (!req_ctx->last && (nbytes + req_ctx->nbuf <= blocksize)) { /* Buffer up to one whole block */ - sg_copy_to_buffer(areq->src, - sg_nents_for_len(areq->src, nbytes), + nents = sg_nents_for_len(areq->src, nbytes); + if (nents < 0) { + dev_err(ctx->dev, "Invalid number of src SG.\n"); + return nents; + } + sg_copy_to_buffer(areq->src, nents, req_ctx->buf + req_ctx->nbuf, nbytes); req_ctx->nbuf += nbytes; return 0; @@ -1867,7 +1890,11 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes) req_ctx->psrc = areq->src; if (to_hash_later) { - int nents = sg_nents_for_len(areq->src, nbytes); + nents = sg_nents_for_len(areq->src, nbytes); + if (nents < 0) { + dev_err(ctx->dev, "Invalid number of src SG.\n"); + return nents; + } sg_pcopy_to_buffer(areq->src, nents, req_ctx->bufnext, to_hash_later,