diff options
| author | Giovanni Cabiddu <giovanni.cabiddu@intel.com> | 2022-05-09 16:34:15 +0300 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2022-05-20 08:49:18 +0300 |
| commit | 2acbb8771f6ac82422886e63832ee7a0f4b1635b (patch) | |
| tree | af78f140fc457ca2d848ac67b6967d128671f205 /drivers/crypto/qat | |
| parent | 9714061423b8b24b8afb31b8eb4df977c63f19c4 (diff) | |
| download | linux-2acbb8771f6ac82422886e63832ee7a0f4b1635b.tar.xz | |
crypto: qat - add param check for DH
Reject requests with a source buffer that is bigger than the size of the
key. This is to prevent a possible integer underflow that might happen
when copying the source scatterlist into a linear buffer.
Cc: stable@vger.kernel.org
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Adam Guerin <adam.guerin@intel.com>
Reviewed-by: Wojciech Ziemba <wojciech.ziemba@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'drivers/crypto/qat')
| -rw-r--r-- | drivers/crypto/qat/qat_common/qat_asym_algs.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c index 947eeff181b4..7173a2a0a484 100644 --- a/drivers/crypto/qat/qat_common/qat_asym_algs.c +++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c @@ -235,6 +235,10 @@ static int qat_dh_compute_value(struct kpp_request *req) req->dst_len = ctx->p_size; return -EOVERFLOW; } + + if (req->src_len > ctx->p_size) + return -EINVAL; + memset(msg, '\0', sizeof(*msg)); ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr, ICP_QAT_FW_COMN_REQ_FLAG_SET); |