]> git.karo-electronics.de Git - karo-tx-linux.git/commit
ENGR00215875-2: caam: fix descriptor buffer overrun in hash_digest_key()
authorSteve Cornelius <steve.cornelius@freescale.com>
Thu, 30 Aug 2012 21:15:39 +0000 (14:15 -0700)
committerLothar Waßmann <LW@KARO-electronics.de>
Fri, 24 May 2013 06:35:22 +0000 (08:35 +0200)
commit55ba4e1c165989c56b705b89e170239e18530851
tree3bdee18da207cda52d32ca8c1448c14423b4c41f
parent952453d6c8eec9fb496127a87a0c9153c3dbef91
ENGR00215875-2: caam: fix descriptor buffer overrun in hash_digest_key()

HMAC keys often need to be reduced to under the size of a digest to
be used. The driver does this psuedo-synchronously through the use of
hash_digest_key(), which builds a sequence pointered job descriptor to
perform this function.

When this function built the job descriptor, it correctly accounted for the
number of instructions and number of pointers that would go into its
construction. However, it failed to account for the fact that both the
sequence in and out pointers used extended lengths, adding 8 more bytes to
the required job descriptor. This caused the descriptor to overrun the
allocated buffer by that amount, resulting in memory corruptions.

Signed-off-by: Steve Cornelius <steve.cornelius@freescale.com>
Signed-off-by: Terry Lv <r65388@freescale.com>
drivers/crypto/caam/caamhash.c
drivers/crypto/caam/desc_constr.h