Skip to contentSkip to conversation

crypto: img-hash - shift wrapping bug in img_hash_hw_init()

PATCH In review Dan Carpenter 3 participants 4 messages Mar 20, 2015 – Mar 23, 2015

Subsystems (2)
Kernel janitors Crypto API
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 2/2 crypto: img-hash - shift wrapping bug in img_hash_hw_init()

"hdev->req->nbytes" is an unsigned int so we so we lose the upper 3 bytes to the shift wrap bug.

Signed-off-by Dan Carpenter <[email protected]>
drivers/crypto/img-hash.c +1 -1
index 601ab35..ad47d0d 100644
@@ -464,7 +464,7 @@ static int img_hash_hw_init(struct img_hash_dev *hdev)
 	img_hash_write(hdev, CR_RESET, CR_RESET_UNSET);
 	img_hash_write(hdev, CR_INTENAB, CR_INT_NEW_RESULTS_SET);
 
-	nbits = (hdev->req->nbytes << 3);
+	nbits = (u64)hdev->req->nbytes << 3;
 	u = nbits >> 32;
 	l = nbits;
 	img_hash_write(hdev, CR_MESSAGE_LENGTH_H, u);
#1 lore raw

Hi Dan,

I'm assuming you mean the upper 3 bits rather than bytes?

Thanks for the patch

James.

Quoted 28 lines

-----Original Message-----
From: Dan Carpenter [mailto:[email protected]]
Sent: 20 March 2015 14:22
To: Herbert Xu; James Hartley
Cc: David S. Miller; [email protected]; kernel- [email protected]
Subject: [patch 2/2] crypto: img-hash - shift wrapping bug in img_hash_hw_init()

"hdev->req->nbytes" is an unsigned int so we so we lose the upper 3 bytes to the shift wrap bug.

Signed-off-by Dan Carpenter <[email protected]>
drivers/crypto/img-hash.c index renamed from drivers/crypto/img-hash.c +0 -0

601ab35..ad47d0d 100644

drivers/crypto/img-hash.c +1 -1
@@ -464,7 +464,7 @@ static int img_hash_hw_init(struct img_hash_dev
 *hdev)
 	img_hash_write(hdev, CR_RESET, CR_RESET_UNSET);
 	img_hash_write(hdev, CR_INTENAB, CR_INT_NEW_RESULTS_SET);
 
-	nbits = (hdev->req->nbytes << 3);
+	nbits = (u64)hdev->req->nbytes << 3;
 	u = nbits >> 32;
 	l = nbits;

img_hash_write(hdev, CR_MESSAGE_LENGTH_H, u);

author
#2 lore raw

PATCH v2 2/2 crypto: img-hash - shift wrapping bug in img_hash_hw_init()

"hdev->req->nbytes" is an unsigned int so we so we lose the upper 3 bits to the shift wrap bug.

Signed-off-by Dan Carpenter <[email protected]>

---
v2: typo in changelog

drivers/crypto/img-hash.c +1 -1
index 601ab35..ad47d0d 100644
@@ -464,7 +464,7 @@ static int img_hash_hw_init(struct img_hash_dev *hdev)
 	img_hash_write(hdev, CR_RESET, CR_RESET_UNSET);
 	img_hash_write(hdev, CR_INTENAB, CR_INT_NEW_RESULTS_SET);
 
-	nbits = (hdev->req->nbytes << 3);
+	nbits = (u64)hdev->req->nbytes << 3;
 	u = nbits >> 32;
 	l = nbits;
 	img_hash_write(hdev, CR_MESSAGE_LENGTH_H, u);

--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

maintainer
#3 lore raw
Quoted 4 lines · Dan Carpenter

"hdev->req->nbytes" is an unsigned int so we so we lose the upper 3 bits to the shift wrap bug.

Signed-off-by Dan Carpenter <[email protected]>

Both patches applied.

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt