Merge "crypto: msm: Check destination buffer write access" (6cb32ce1) · Commits · e / devices / samsung / android_kernel_samsung_msm8916

drivers/crypto/msm/qcedev.c

+31 −6

Original line number	Original line	Diff line number	Diff line
	@@ -1413,12 +1413,37 @@ static int qcedev_vbuf_ablk_cipher(struct qcedev_async_req *areq,
	return -EFAULT;		return -EFAULT;

	/* Verify Destination Address's */		/* Verify Destination Address's */
	if (areq->cipher_op_req.in_place_op != 1)		if (creq->in_place_op != 1) {
	for (i = 0; i < areq->cipher_op_req.entries; i++)		for (i = 0, total = 0; i < QCEDEV_MAX_BUFFERS; i++) {
	if (!access_ok(VERIFY_READ,		if ((areq->cipher_op_req.vbuf.dst[i].vaddr != 0) &&
	(void __user *)areq->cipher_op_req.vbuf.dst[i].vaddr,		(total < creq->data_len)) {
	areq->cipher_op_req.vbuf.dst[i].len))		if (!access_ok(VERIFY_WRITE,
			(void __user *)creq->vbuf.dst[i].vaddr,
			creq->vbuf.dst[i].len)) {
			pr_err("%s:DST WR_VERIFY err %d=0x%x\n",
			__func__, i,
			(u32)creq->vbuf.dst[i].vaddr);
			return -EFAULT;
			}
			total += creq->vbuf.dst[i].len;
			}
			}
			} else {
			for (i = 0, total = 0; i < creq->entries; i++) {
			if (total < creq->data_len) {
			if (!access_ok(VERIFY_WRITE,
			(void __user *)creq->vbuf.src[i].vaddr,
			creq->vbuf.src[i].len)) {
			pr_err("%s:SRC WR_VERIFY err %d=0x%x\n",
			__func__, i,
			(u32)creq->vbuf.src[i].vaddr);
	return -EFAULT;		return -EFAULT;
			}
			total += creq->vbuf.src[i].len;
			}
			}
			}
			total = 0;

	if (areq->cipher_op_req.mode == QCEDEV_AES_MODE_CTR)		if (areq->cipher_op_req.mode == QCEDEV_AES_MODE_CTR)
	byteoffset = areq->cipher_op_req.byteoffset;		byteoffset = areq->cipher_op_req.byteoffset;