Skip to contentSkip to conversation

Patch "crypto: caam - fix memory corruption in ahash_final_ctx" has been added to the 3.14-stable tree

PATCH [email protected] 1 participant 1 message Sep 11, 2015

Subsystems (3)
Stable branch Crypto API Freescale CAAM (Cryptographic Acceleration and Assurance Module) driver
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

crypto: caam - fix memory corruption in ahash_final_ctx

to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From b310c178e6d897f82abb9da3af1cd7c02b09f592 Mon Sep 17 00:00:00 2001

From: Horia Geant? <[email protected]>
Date: Tue, 11 Aug 2015 20:19:20 +0300
Subject: crypto: caam - fix memory corruption in ahash_final_ctx

From: Horia Geant? <[email protected]>

commit b310c178e6d897f82abb9da3af1cd7c02b09f592 upstream.

When doing pointer operation for accessing the HW S/G table, a value representing number of entries (and not number of bytes) must be used.

Fixes 045e36780f115 ("crypto: caam - ahash hmac support")
Signed-off-by Horia Geant? <[email protected]>
Signed-off-by Herbert Xu <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/crypto/caam/caamhash.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/crypto/caam/caamhash.c +4 -3
@@ -900,13 +900,14 @@ static int ahash_final_ctx(struct ahash_
 			  state->buflen_1;
 	u32 *sh_desc = ctx->sh_desc_fin, *desc;
 	dma_addr_t ptr = ctx->sh_desc_fin_dma;
-	int sec4_sg_bytes;
+	int sec4_sg_bytes, sec4_sg_src_index;
 	int digestsize = crypto_ahash_digestsize(ahash);
 	struct ahash_edesc *edesc;
 	int ret = 0;
 	int sh_len;
 
-	sec4_sg_bytes = (1 + (buflen ? 1 : 0)) * sizeof(struct sec4_sg_entry);
+	sec4_sg_src_index = 1 + (buflen ? 1 : 0);
+	sec4_sg_bytes = sec4_sg_src_index * sizeof(struct sec4_sg_entry);
 
 	/* allocate space for base edesc and hw desc commands, link tables */
 	edesc = kmalloc(sizeof(struct ahash_edesc) + DESC_JOB_IO_LEN +

@@ -933,7 +934,7 @@ static int ahash_final_ctx(struct ahash_
 	state->buf_dma = try_buf_map_to_sec4_sg(jrdev, edesc->sec4_sg + 1,
 						buf, state->buf_dma, buflen,
 						last_buflen);
-	(edesc->sec4_sg + sec4_sg_bytes - 1)->len |= SEC4_SG_LEN_FIN;
+	(edesc->sec4_sg + sec4_sg_src_index - 1)->len |= SEC4_SG_LEN_FIN;
 
 	append_seq_in_ptr(desc, edesc->sec4_sg_dma, ctx->ctx_len + buflen,
 			  LDST_SGF);

Patches currently in stable-queue which might be from [email protected] are

queue-3.14/crypto-caam-fix-memory-corruption-in-ahash_final_ctx.patch