Commit e9eb5203 authored by Haotian Zhang's avatar Haotian Zhang Committed by Herbert Xu
Browse files

crypto: starfive - Correctly handle return of sg_nents_for_len 



The return value of sg_nents_for_len was assigned to an unsigned long
in starfive_hash_digest, causing negative error codes to be converted
to large positive integers.

Add error checking for sg_nents_for_len and return immediately on
failure to prevent potential buffer overflows.

Fixes: 7883d1b2 ("crypto: starfive - Add hash and HMAC support")
Signed-off-by: default avatarHaotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 76ce17f6

drivers/crypto/starfive/jh7110-hash.c

+5 −1
Original line number Diff line number Diff line
@@ -325,6 +325,7 @@ static int starfive_hash_digest(struct ahash_request *req) 
	struct starfive_cryp_ctx *ctx = crypto_ahash_ctx(tfm);

	struct starfive_cryp_request_ctx *rctx = ahash_request_ctx(req);

	struct starfive_cryp_dev *cryp = ctx->cryp;

	int sg_len;



	memset(rctx, 0, sizeof(struct starfive_cryp_request_ctx));
@@ -333,7 +334,10 @@ static int starfive_hash_digest(struct ahash_request *req) 
	rctx->in_sg = req->src;

	rctx->blksize = crypto_tfm_alg_blocksize(crypto_ahash_tfm(tfm));

	rctx->digsize = crypto_ahash_digestsize(tfm);

	rctx->in_sg_len = sg_nents_for_len(rctx->in_sg, rctx->total);

	sg_len = sg_nents_for_len(rctx->in_sg, rctx->total);

	if (sg_len < 0)

		return sg_len;

	rctx->in_sg_len = sg_len;

	ctx->rctx = rctx;



	return crypto_transfer_hash_request_to_engine(cryp->engine, req);