Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fe0ab0cc authored by Mona Hossain's avatar Mona Hossain
Browse files

crypto: msm: Verify source and destination data lengths 



Check to confirm the sum of length of the source
and destination segments is equal to the total length
sent by client.

Change-Id: Ib10b8f792591631060135022d81f1f08c424ee66
Signed-off-by: default avatarMona Hossain <mhossain@codeaurora.org>
parent 66d0b021

drivers/crypto/msm/qcedev.c

+19 −1
Original line number Diff line number Diff line
@@ -1619,6 +1619,9 @@ error: 
static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req,

						struct qcedev_control *podev)

{

	uint32_t total = 0;

	uint32_t i;



	if (req->use_pmem) {

		pr_err("%s: Use of PMEM is not supported\n", __func__);

		goto error;
@@ -1670,7 +1673,22 @@ static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req, 
			goto error;

		}

	}



	/* Check for sum of all dst length is equal to data_len  */

	for (i = 0; (i < QCEDEV_MAX_BUFFERS) && (total < req->data_len); i++)

		total += req->vbuf.dst[i].len;

	if (total != req->data_len) {

		pr_err("%s: Total (i=%d) dst(%d) buf size != data_len (%d)\n",

			__func__, i, total, req->data_len);

		goto error;

	}

	/* Check for sum of all src length is equal to data_len  */

	for (i = 0, total = 0; i < req->entries; i++)

		total += req->vbuf.src[i].len;

	if (total != req->data_len) {

		pr_err("%s: Total src(%d) buf size != data_len (%d)\n",

			__func__, total, req->data_len);

		goto error;

	}

	return 0;

error:

	return -EINVAL;