crypto: chelsio - check set_msg_len overflow in generate_b0 (66af86d9) · Commits · 戴 / test

drivers/crypto/chelsio/chcr_algo.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -2762,7 +2762,7 @@ static int set_msg_len(u8 *block, unsigned int msglen, int csize)
		return 0;
		}

		static void generate_b0(struct aead_request req, u8 ivptr,
		static int generate_b0(struct aead_request req, u8 ivptr,
		unsigned short op_type)
		{
		unsigned int l, lp, m;
		@@ -2787,6 +2787,8 @@ static void generate_b0(struct aead_request req, u8 ivptr,
		rc = set_msg_len(b0 + 16 - l,
		(op_type == CHCR_DECRYPT_OP) ?
		req->cryptlen - m : req->cryptlen, l);

		return rc;
		}

		static inline int crypto_ccm_check_iv(const u8 *iv)
		@@ -2821,7 +2823,7 @@ static int ccm_format_packet(struct aead_request *req,
		((unsigned short )(reqctx->scratch_pad + 16)) =
		htons(assoclen);

		generate_b0(req, ivptr, op_type);
		rc = generate_b0(req, ivptr, op_type);
		/* zero the ctr value */
		memset(ivptr + 15 - ivptr[0], 0, ivptr[0] + 1);
		return rc;