|
Torsten Duwe |
dc5413 |
From 2acbb8771f6ac82422886e63832ee7a0f4b1635b Mon Sep 17 00:00:00 2001
|
|
Torsten Duwe |
dc5413 |
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
|
|
Torsten Duwe |
dc5413 |
Date: Mon, 9 May 2022 14:34:15 +0100
|
|
Torsten Duwe |
dc5413 |
Subject: [PATCH] crypto: qat - add param check for DH
|
|
Torsten Duwe |
dc5413 |
Git-commit: 2acbb8771f6ac82422886e63832ee7a0f4b1635b
|
|
Torsten Duwe |
dc5413 |
Patch-mainline: v5.19-rc1
|
|
Torsten Duwe |
dc5413 |
References: jsc#PED-1073
|
|
Torsten Duwe |
dc5413 |
|
|
Torsten Duwe |
dc5413 |
Reject requests with a source buffer that is bigger than the size of the
|
|
Torsten Duwe |
dc5413 |
key. This is to prevent a possible integer underflow that might happen
|
|
Torsten Duwe |
dc5413 |
when copying the source scatterlist into a linear buffer.
|
|
Torsten Duwe |
dc5413 |
|
|
Torsten Duwe |
dc5413 |
Cc: stable@vger.kernel.org
|
|
Torsten Duwe |
dc5413 |
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
|
|
Torsten Duwe |
dc5413 |
Reviewed-by: Adam Guerin <adam.guerin@intel.com>
|
|
Torsten Duwe |
dc5413 |
Reviewed-by: Wojciech Ziemba <wojciech.ziemba@intel.com>
|
|
Torsten Duwe |
dc5413 |
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
Torsten Duwe |
dc5413 |
Signed-off-by: Torsten Duwe <duwe@suse.de>
|
|
Torsten Duwe |
dc5413 |
|
|
Torsten Duwe |
dc5413 |
---
|
|
Torsten Duwe |
dc5413 |
drivers/crypto/qat/qat_common/qat_asym_algs.c | 4 ++++
|
|
Torsten Duwe |
dc5413 |
1 file changed, 4 insertions(+)
|
|
Torsten Duwe |
dc5413 |
|
|
Torsten Duwe |
dc5413 |
diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c
|
|
Torsten Duwe |
dc5413 |
index 947eeff181b49..7173a2a0a484f 100644
|
|
Torsten Duwe |
dc5413 |
--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c
|
|
Torsten Duwe |
dc5413 |
+++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c
|
|
Torsten Duwe |
dc5413 |
@@ -235,6 +235,10 @@ static int qat_dh_compute_value(struct kpp_request *req)
|
|
Torsten Duwe |
dc5413 |
req->dst_len = ctx->p_size;
|
|
Torsten Duwe |
dc5413 |
return -EOVERFLOW;
|
|
Torsten Duwe |
dc5413 |
}
|
|
Torsten Duwe |
dc5413 |
+
|
|
Torsten Duwe |
dc5413 |
+ if (req->src_len > ctx->p_size)
|
|
Torsten Duwe |
dc5413 |
+ return -EINVAL;
|
|
Torsten Duwe |
dc5413 |
+
|
|
Torsten Duwe |
dc5413 |
memset(msg, '\0', sizeof(*msg));
|
|
Torsten Duwe |
dc5413 |
ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr,
|
|
Torsten Duwe |
dc5413 |
ICP_QAT_FW_COMN_REQ_FLAG_SET);
|
|
Torsten Duwe |
dc5413 |
--
|
|
Torsten Duwe |
dc5413 |
2.35.3
|
|
Torsten Duwe |
dc5413 |
|