Received: by 2002:a25:ef43:0:0:0:0:0 with SMTP id w3csp1064234ybm; Wed, 27 May 2020 15:19:46 -0700 (PDT) X-Google-Smtp-Source: ABdhPJztVi6e7V6qXEmZ+2j27CG0LwJ6U268i98Eqw97NkB/f3IqoExbvumUy8kmXgSN56Eywoll X-Received: by 2002:a17:906:9404:: with SMTP id q4mr442080ejx.138.1590617986014; Wed, 27 May 2020 15:19:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1590617986; cv=none; d=google.com; s=arc-20160816; b=ng2Qowq9R5hGQYJXuOqLL8O8llcmZb10DlTmxzy/ZdHmVdbh7hNTkPdYxfbRLe1AZQ dajEm7GoCG8OmGpzMwRYVN5gt5Gyg03/eNwxft9Q1GIUjROPRUQExon0LcGADJbWAxzQ ZVk+V0xQsd0NT5lWWH70UoQ+qxfdISupLFWSS6wTtnLj9/wkZpJcNkoVXmXGzz+jvaZv c3fVwBGmWNCvKVAOi0EaTKT4vHfpxqP+D1ZnfmhwzhzcwR9pXo7x9Sd/ACnH7Aw50hQX 6iSxR2IXxOQMd8rryREmwlFB6fTHbrOnjraoza4fx0Y4UL9lD7DZ0zhggmQTQ8z3WeRm H0Cw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:ironport-sdr:ironport-sdr; bh=MWLIaNQvjcicCeaZOLBSuiuC6DFm+4AGawKJeXwNRfI=; b=HM0Tw9nuJeHphIB160iY594+hU/jsaULXGc382RnrQqkyWLMYREr0nxncUrLPoprKc LZkFxrVvtVmlflKcrbbT2/UmRYlj5BT4aL7tzafPwxXuW8QGNqNomys5vVXYwMVO6d2C oD7PzXO8tcuZCDwhQCGWIfQ8VyLhSCkYQbKuTsdF5QAi4nieMpLLoD5dZLq/Gsy92gc5 ATN3nIZQnsJH7U3+Dhf92dX7TcUOaEyK5t6XyKioki5rQz55g+1LQKSsc8H4J9Ih0oXo qOmP3eLtNy7Lfs6Ba3XrsjHdckKGqyocTRpgCorTkfNk1mKS1+7xjo8WKK19koArC12T vlQQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id t11si2411740edt.523.2020.05.27.15.19.15; Wed, 27 May 2020 15:19:45 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725681AbgE0WTN (ORCPT + 99 others); Wed, 27 May 2020 18:19:13 -0400 Received: from mga02.intel.com ([134.134.136.20]:46044 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725385AbgE0WTM (ORCPT ); Wed, 27 May 2020 18:19:12 -0400 IronPort-SDR: j2q3Qs80feiizNk9aheku5nncnGUlayOAb0EHUAv08gw+9Tl8hfpowAGmZk8M1W85b9JsXLTfN 0vR9PbQ4fu8g== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 May 2020 15:19:12 -0700 IronPort-SDR: kkvQe6/BRtWrrUfNXpNvWwtU2TKP/4KqHaDz1To2TRLP679m/WdepqX/N9IuBRIqZOPOPtzQ+p Ln76wYrwdrXA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.73,442,1583222400"; d="scan'208";a="468903693" Received: from silpixa00400314.ir.intel.com (HELO silpixa00400314.ger.corp.intel.com) ([10.237.222.51]) by fmsmga006.fm.intel.com with ESMTP; 27 May 2020 15:19:11 -0700 From: Giovanni Cabiddu To: herbert@gondor.apana.org.au Cc: linux-crypto@vger.kernel.org, Giovanni Cabiddu Subject: [PATCH] crypto: qat - fix parameter check in aead encryption Date: Wed, 27 May 2020 23:18:52 +0100 Message-Id: <20200527221852.4942-1-giovanni.cabiddu@intel.com> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Return -EINVAL if the input digest size and/or cipher length is zero or the cipher length is not multiple of a block. These additional parameter checks prevent an undefined device behaviour. Signed-off-by: Giovanni Cabiddu --- drivers/crypto/qat/qat_common/qat_algs.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c index 9df4aebf37ca..00e10a4d578a 100644 --- a/drivers/crypto/qat/qat_common/qat_algs.c +++ b/drivers/crypto/qat/qat_common/qat_algs.c @@ -825,8 +825,15 @@ static int qat_alg_aead_dec(struct aead_request *areq) struct icp_qat_fw_la_auth_req_params *auth_param; struct icp_qat_fw_la_bulk_req *msg; int digst_size = crypto_aead_authsize(aead_tfm); + u32 cipher_length = areq->cryptlen - digst_size; int ret, ctr = 0; + if (!digst_size || !areq->cryptlen || !cipher_length) + return -EINVAL; + + if (cipher_length % AES_BLOCK_SIZE != 0) + return -EINVAL; + ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); if (unlikely(ret)) return ret; @@ -840,7 +847,7 @@ static int qat_alg_aead_dec(struct aead_request *areq) qat_req->req.comn_mid.src_data_addr = qat_req->buf.blp; qat_req->req.comn_mid.dest_data_addr = qat_req->buf.bloutp; cipher_param = (void *)&qat_req->req.serv_specif_rqpars; - cipher_param->cipher_length = areq->cryptlen - digst_size; + cipher_param->cipher_length = cipher_length; cipher_param->cipher_offset = areq->assoclen; memcpy(cipher_param->u.cipher_IV_array, areq->iv, AES_BLOCK_SIZE); auth_param = (void *)((uint8_t *)cipher_param + sizeof(*cipher_param)); @@ -869,6 +876,12 @@ static int qat_alg_aead_enc(struct aead_request *areq) uint8_t *iv = areq->iv; int ret, ctr = 0; + if (!areq->cryptlen) + return -EINVAL; + + if (areq->cryptlen % AES_BLOCK_SIZE != 0) + return -EINVAL; + ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req); if (unlikely(ret)) return ret; -- 2.26.2