Commit f9970c28 authored by LABBE Corentin's avatar LABBE Corentin Committed by Herbert Xu

crypto: caam - check return value of sg_nents_for_len

The sg_nents_for_len() function could fail, this patch add a check for
its return value.
We do the same for sg_count since it use sg_nents_for_len().
Signed-off-by: default avatarLABBE Corentin <clabbe.montjoie@gmail.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent f051f95e
...@@ -803,6 +803,10 @@ static int ahash_update_ctx(struct ahash_request *req) ...@@ -803,6 +803,10 @@ static int ahash_update_ctx(struct ahash_request *req)
if (to_hash) { if (to_hash) {
src_nents = sg_nents_for_len(req->src, src_nents = sg_nents_for_len(req->src,
req->nbytes - (*next_buflen)); req->nbytes - (*next_buflen));
if (src_nents < 0) {
dev_err(jrdev, "Invalid number of src SG.\n");
return src_nents;
}
sec4_sg_src_index = 1 + (*buflen ? 1 : 0); sec4_sg_src_index = 1 + (*buflen ? 1 : 0);
sec4_sg_bytes = (sec4_sg_src_index + src_nents) * sec4_sg_bytes = (sec4_sg_src_index + src_nents) *
sizeof(struct sec4_sg_entry); sizeof(struct sec4_sg_entry);
...@@ -1002,6 +1006,10 @@ static int ahash_finup_ctx(struct ahash_request *req) ...@@ -1002,6 +1006,10 @@ static int ahash_finup_ctx(struct ahash_request *req)
int sh_len; int sh_len;
src_nents = sg_nents_for_len(req->src, req->nbytes); src_nents = sg_nents_for_len(req->src, req->nbytes);
if (src_nents < 0) {
dev_err(jrdev, "Invalid number of src SG.\n");
return src_nents;
}
sec4_sg_src_index = 1 + (buflen ? 1 : 0); sec4_sg_src_index = 1 + (buflen ? 1 : 0);
sec4_sg_bytes = (sec4_sg_src_index + src_nents) * sec4_sg_bytes = (sec4_sg_src_index + src_nents) *
sizeof(struct sec4_sg_entry); sizeof(struct sec4_sg_entry);
...@@ -1086,6 +1094,10 @@ static int ahash_digest(struct ahash_request *req) ...@@ -1086,6 +1094,10 @@ static int ahash_digest(struct ahash_request *req)
int sh_len; int sh_len;
src_nents = sg_count(req->src, req->nbytes); src_nents = sg_count(req->src, req->nbytes);
if (src_nents < 0) {
dev_err(jrdev, "Invalid number of src SG.\n");
return src_nents;
}
dma_map_sg(jrdev, req->src, src_nents ? : 1, DMA_TO_DEVICE); dma_map_sg(jrdev, req->src, src_nents ? : 1, DMA_TO_DEVICE);
sec4_sg_bytes = src_nents * sizeof(struct sec4_sg_entry); sec4_sg_bytes = src_nents * sizeof(struct sec4_sg_entry);
...@@ -1234,6 +1246,10 @@ static int ahash_update_no_ctx(struct ahash_request *req) ...@@ -1234,6 +1246,10 @@ static int ahash_update_no_ctx(struct ahash_request *req)
if (to_hash) { if (to_hash) {
src_nents = sg_nents_for_len(req->src, src_nents = sg_nents_for_len(req->src,
req->nbytes - (*next_buflen)); req->nbytes - (*next_buflen));
if (src_nents < 0) {
dev_err(jrdev, "Invalid number of src SG.\n");
return src_nents;
}
sec4_sg_bytes = (1 + src_nents) * sec4_sg_bytes = (1 + src_nents) *
sizeof(struct sec4_sg_entry); sizeof(struct sec4_sg_entry);
...@@ -1342,6 +1358,10 @@ static int ahash_finup_no_ctx(struct ahash_request *req) ...@@ -1342,6 +1358,10 @@ static int ahash_finup_no_ctx(struct ahash_request *req)
int ret = 0; int ret = 0;
src_nents = sg_nents_for_len(req->src, req->nbytes); src_nents = sg_nents_for_len(req->src, req->nbytes);
if (src_nents < 0) {
dev_err(jrdev, "Invalid number of src SG.\n");
return src_nents;
}
sec4_sg_src_index = 2; sec4_sg_src_index = 2;
sec4_sg_bytes = (sec4_sg_src_index + src_nents) * sec4_sg_bytes = (sec4_sg_src_index + src_nents) *
sizeof(struct sec4_sg_entry); sizeof(struct sec4_sg_entry);
...@@ -1430,6 +1450,10 @@ static int ahash_update_first(struct ahash_request *req) ...@@ -1430,6 +1450,10 @@ static int ahash_update_first(struct ahash_request *req)
if (to_hash) { if (to_hash) {
src_nents = sg_count(req->src, req->nbytes - (*next_buflen)); src_nents = sg_count(req->src, req->nbytes - (*next_buflen));
if (src_nents < 0) {
dev_err(jrdev, "Invalid number of src SG.\n");
return src_nents;
}
dma_map_sg(jrdev, req->src, src_nents ? : 1, DMA_TO_DEVICE); dma_map_sg(jrdev, req->src, src_nents ? : 1, DMA_TO_DEVICE);
sec4_sg_bytes = src_nents * sizeof(struct sec4_sg_entry); sec4_sg_bytes = src_nents * sizeof(struct sec4_sg_entry);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment