Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fe0ab0cc authored by Mona Hossain's avatar Mona Hossain
Browse files

crypto: msm: Verify source and destination data lengths



Check to confirm the sum of length of the source
and destination segments is equal to the total length
sent by client.

Change-Id: Ib10b8f792591631060135022d81f1f08c424ee66
Signed-off-by: default avatarMona Hossain <mhossain@codeaurora.org>
parent 66d0b021
Loading
Loading
Loading
Loading
+19 −1
Original line number Diff line number Diff line
@@ -1619,6 +1619,9 @@ error:
static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req,
						struct qcedev_control *podev)
{
	uint32_t total = 0;
	uint32_t i;

	if (req->use_pmem) {
		pr_err("%s: Use of PMEM is not supported\n", __func__);
		goto error;
@@ -1670,7 +1673,22 @@ static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req,
			goto error;
		}
	}

	/* Check for sum of all dst length is equal to data_len  */
	for (i = 0; (i < QCEDEV_MAX_BUFFERS) && (total < req->data_len); i++)
		total += req->vbuf.dst[i].len;
	if (total != req->data_len) {
		pr_err("%s: Total (i=%d) dst(%d) buf size != data_len (%d)\n",
			__func__, i, total, req->data_len);
		goto error;
	}
	/* Check for sum of all src length is equal to data_len  */
	for (i = 0, total = 0; i < req->entries; i++)
		total += req->vbuf.src[i].len;
	if (total != req->data_len) {
		pr_err("%s: Total src(%d) buf size != data_len (%d)\n",
			__func__, total, req->data_len);
		goto error;
	}
	return 0;
error:
	return -EINVAL;