Moving limit and bound logic in CTR and fix IV vector
Subsystems (3)
PATCH 3/9 Moving limit and bound logic in CTR and fix IV vector
The previous limits were estimated locally in a single step basead on bound values, however it was not correct since when given certain scatterlist the function nx_build_sg_lists was consuming more sg entries than allocated causing a memory corruption and crashes.
- This patch removes the old logic and replaces it into nx_sg_build_lists in order to build a correct nx_sg list using the correct sg_max limit and bounds.
IV vector was not set correctly to zero causing ctr crash in tcrypt tests.
- Fixed setting IV vector bits to zero.
Signed-off-by Leonidas S. Barbosa <[email protected]>
--- drivers/crypto/nx/nx-aes-ctr.c | 13 +++---------- 1 files changed, 3 insertions(+), 10 deletions(-)
drivers/crypto/nx/nx-aes-ctr.c +3 -10
@@ -90,22 +90,14 @@ static int ctr_aes_nx_crypt(struct blkcipher_desc *desc,struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;unsigned long irq_flags;unsigned int processed =0 , to_process; -u32 max_sg_len;int rc;spin_lock_irqsave (&nx_ctx->lock, irq_flags); - max_sg_len =min_t (u32, nx_driver.of.max_sg_len/sizeof (struct nx_sg ), - nx_ctx->ap->sglen); - do { - to_process = min_t(u64, nbytes - processed, - nx_ctx->ap->databytelen); - to_process = min_t(u64, to_process, - NX_PAGE_SIZE * (max_sg_len - 1)); - to_process = to_process & ~(AES_BLOCK_SIZE - 1); + to_process = nbytes - processed; - rc = nx_build_sg_lists(nx_ctx, desc, dst, src, to_process, + rc = nx_build_sg_lists(nx_ctx, desc, dst, src, &to_process, processed, csbcpb->cpb.aes_ctr.iv); if (rc) goto out;
@@ -143,6 +135,7 @@ static int ctr3686_aes_nx_crypt(struct blkcipher_desc *desc,memcpy (iv +CTR_RFC3686_NONCE_SIZE , desc->info,CTR_RFC3686_IV_SIZE ); + iv[12 ] = iv[13 ] = iv[14 ] =0 ; iv[15 ] =1 ; desc->info = nx_ctx->priv.ctr.iv;
Signature · 1 line
1.7.1