Commit dd52b5ee authored by David Gstir's avatar David Gstir Committed by Herbert Xu
Browse files

crypto: mxs-dcp - Ensure payload is zero when using key slot 



We could leak stack memory through the payload field when running
AES with a key from one of the hardware's key slots. Fix this by
ensuring the payload field is set to 0 in such cases.

This does not affect the common use case when the key is supplied
from main memory via the descriptor payload.

Signed-off-by: default avatarDavid Gstir <david@sigma-star.at>
Reported-by: default avatarkernel test robot <lkp@intel.com>
Reported-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202405270146.Y9tPoil8-lkp@intel.com/


Fixes: 3d16af0b ("crypto: mxs-dcp: Add support for hardware-bound keys")
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent addea585

drivers/crypto/mxs-dcp.c

+2 −1
Original line number Diff line number Diff line
@@ -225,7 +225,8 @@ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx) 
static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,

			   struct skcipher_request *req, int init)

{

	dma_addr_t key_phys, src_phys, dst_phys;

	dma_addr_t key_phys = 0;

	dma_addr_t src_phys, dst_phys;

	struct dcp *sdcp = global_sdcp;

	struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];

	struct dcp_aes_req_ctx *rctx = skcipher_request_ctx(req);