]> git.karo-electronics.de Git - karo-tx-linux.git/commit
ENGR00215875-2: caam: fix descriptor buffer overrun in hash_digest_key()
authorSteve Cornelius <steve.cornelius@freescale.com>
Thu, 30 Aug 2012 21:15:39 +0000 (14:15 -0700)
committerOliver Wendt <ow@karo-electronics.de>
Mon, 30 Sep 2013 12:12:55 +0000 (14:12 +0200)
commit41922413ac433ee3e561470d47d7acc143063ad6
tree3bdee18da207cda52d32ca8c1448c14423b4c41f
parent7759b8ce074f5bd3b6f609103d17424aa3d4ee03
ENGR00215875-2: caam: fix descriptor buffer overrun in hash_digest_key()

HMAC keys often need to be reduced to under the size of a digest to
be used. The driver does this psuedo-synchronously through the use of
hash_digest_key(), which builds a sequence pointered job descriptor to
perform this function.

When this function built the job descriptor, it correctly accounted for the
number of instructions and number of pointers that would go into its
construction. However, it failed to account for the fact that both the
sequence in and out pointers used extended lengths, adding 8 more bytes to
the required job descriptor. This caused the descriptor to overrun the
allocated buffer by that amount, resulting in memory corruptions.

Signed-off-by: Steve Cornelius <steve.cornelius@freescale.com>
Signed-off-by: Terry Lv <r65388@freescale.com>
drivers/crypto/caam/caamhash.c
drivers/crypto/caam/desc_constr.h