Commit a7a1f3cd authored by Paul Moses's avatar Paul Moses Committed by Herbert Xu
Browse files

crypto: ccp - copy IV using skcipher ivsize 



AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver.

ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV
buffer while RFC3686 skciphers expose an 8-byte IV, so the restore
overruns the provided buffer.

Use crypto_skcipher_ivsize() to copy only the algorithm's IV length.

Fixes: 2b789435 ("crypto: ccp - CCP AES crypto API support")
Signed-off-by: default avatarPaul Moses <p@1g4.org>
Reviewed-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 4f685dbf

drivers/crypto/ccp/ccp-crypto-aes.c

+5 −2
Original line number Diff line number Diff line
@@ -30,8 +30,11 @@ static int ccp_aes_complete(struct crypto_async_request *async_req, int ret) 
	if (ret)

		return ret;



	if (ctx->u.aes.mode != CCP_AES_MODE_ECB)

		memcpy(req->iv, rctx->iv, AES_BLOCK_SIZE);

	if (ctx->u.aes.mode != CCP_AES_MODE_ECB) {

		size_t ivsize = crypto_skcipher_ivsize(crypto_skcipher_reqtfm(req));



		memcpy(req->iv, rctx->iv, ivsize);

	}



	return 0;

}