Date:   Fri, 3 Feb 2023 16:48:12 +0800
From:   Herbert Xu <herbert@gondor.apana.org.au>
To:     Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Cc:     linux-crypto@vger.kernel.org, qat-linux@intel.com,
        stable@vger.kernel.org, Vladis Dronov <vdronov@redhat.com>,
        Fiona Trahe <fiona.trahe@intel.com>
Subject: Re: [PATCH] crypto: qat - fix out-of-bounds read
Message-ID: <Y9zKTHFvYHrmfqdW@gondor.apana.org.au>
References: <20230201155944.23379-1-giovanni.cabiddu@intel.com>
 <Y9xduyjbaxFdaCUT@gondor.apana.org.au>
 <Y9yrZk9KnICxqkZp@gcabiddu-mobl1.ger.corp.intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Y9yrZk9KnICxqkZp@gcabiddu-mobl1.ger.corp.intel.com>
Precedence: bulk

On Fri, Feb 03, 2023 at 06:36:22AM +0000, Giovanni Cabiddu wrote:
>
> The content descriptor structure (cd) is already initialized to zero
> before the function qat_alg_skcipher_init_com() is called.
> This is done in
>   (1) qat_alg_skcipher_newkey() implicitly by dma_alloc_coherent(),
>       the first time setkey() is called for a tfm or

Sorry but what zeroes the memory in this case? The only zeroing
I can find in newkey is when you free the memory.

>   (2) qat_alg_skcipher_rekey() explicitly, for subsequent calls to
>       sekey().

This looks fine.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt