Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'v6.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
- Fix UAF in seqiv
- Fix regression in hisilicon
* tag 'v6.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: hisilicon/qm - fix incorrect judgment in qm_get_complete_eqe_num()
crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
+9
-8
+5
-3
crypto/seqiv.c
+5
-3
crypto/seqiv.c
···
50
50
struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
51
51
struct aead_request *subreq = aead_request_ctx(req);
52
52
crypto_completion_t compl;
53
+
bool unaligned_info;
53
54
void *data;
54
55
u8 *info;
55
56
unsigned int ivsize = 8;
···
69
68
memcpy_sglist(req->dst, req->src,
70
69
req->assoclen + req->cryptlen);
71
70
72
-
if (unlikely(!IS_ALIGNED((unsigned long)info,
73
-
crypto_aead_alignmask(geniv) + 1))) {
71
+
unaligned_info = !IS_ALIGNED((unsigned long)info,
72
+
crypto_aead_alignmask(geniv) + 1);
73
+
if (unlikely(unaligned_info)) {
74
74
info = kmemdup(req->iv, ivsize, req->base.flags &
75
75
CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL :
76
76
GFP_ATOMIC);
···
91
89
scatterwalk_map_and_copy(info, req->dst, req->assoclen, ivsize, 1);
92
90
93
91
err = crypto_aead_encrypt(subreq);
94
-
if (unlikely(info != req->iv))
92
+
if (unlikely(unaligned_info))
95
93
seqiv_aead_encrypt_complete2(req, err);
96
94
return err;
97
95
}
+4
-5
drivers/crypto/hisilicon/qm.c
+4
-5
drivers/crypto/hisilicon/qm.c
···
991
991
return;
992
992
poll_data = &qm->poll_data[cqn];
993
993
994
-
while (QM_EQE_PHASE(dw0) != qm->status.eqc_phase) {
994
+
do {
995
995
poll_data->qp_finish_id[eqe_num] = dw0 & QM_EQE_CQN_MASK;
996
996
eqe_num++;
997
997
···
1004
1004
qm->status.eq_head++;
1005
1005
}
1006
1006
1007
-
if (eqe_num == (eq_depth >> 1) - 1)
1008
-
break;
1009
-
1010
1007
dw0 = le32_to_cpu(eqe->dw0);
1011
-
}
1008
+
if (QM_EQE_PHASE(dw0) != qm->status.eqc_phase)
1009
+
break;
1010
+
} while (eqe_num < (eq_depth >> 1) - 1);
1012
1011
1013
1012
poll_data->eqe_num = eqe_num;
1014
1013
queue_work(qm->wq, &poll_data->work);