Skip to content

Commit e9eb520

Browse files
ISCAS-Vulabherbertx
authored andcommitted
crypto: starfive - Correctly handle return of sg_nents_for_len
The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to be converted to large positive integers. Add error checking for sg_nents_for_len and return immediately on failure to prevent potential buffer overflows. Fixes: 7883d1b ("crypto: starfive - Add hash and HMAC support") Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
1 parent 76ce17f commit e9eb520

1 file changed

Lines changed: 5 additions & 1 deletion

File tree

drivers/crypto/starfive/jh7110-hash.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -325,6 +325,7 @@ static int starfive_hash_digest(struct ahash_request *req)
325325
struct starfive_cryp_ctx *ctx = crypto_ahash_ctx(tfm);
326326
struct starfive_cryp_request_ctx *rctx = ahash_request_ctx(req);
327327
struct starfive_cryp_dev *cryp = ctx->cryp;
328+
int sg_len;
328329

329330
memset(rctx, 0, sizeof(struct starfive_cryp_request_ctx));
330331

@@ -333,7 +334,10 @@ static int starfive_hash_digest(struct ahash_request *req)
333334
rctx->in_sg = req->src;
334335
rctx->blksize = crypto_tfm_alg_blocksize(crypto_ahash_tfm(tfm));
335336
rctx->digsize = crypto_ahash_digestsize(tfm);
336-
rctx->in_sg_len = sg_nents_for_len(rctx->in_sg, rctx->total);
337+
sg_len = sg_nents_for_len(rctx->in_sg, rctx->total);
338+
if (sg_len < 0)
339+
return sg_len;
340+
rctx->in_sg_len = sg_len;
337341
ctx->rctx = rctx;
338342

339343
return crypto_transfer_hash_request_to_engine(cryp->engine, req);

0 commit comments

Comments
 (0)