diff options
| author |   Ard Biesheuvel <ard.biesheuvel@linaro.org> | 2018-11-08 23:55:16 +0100 |
|---|---|---|
| committer |   Herbert Xu <herbert@gondor.apana.org.au> | 2018-11-09 17:35:43 +0800 |
| commit | 508a1c4df085a547187eed346f1bfe5e381797f1 (patch) | |
| tree | 305437fd79b83c0a873479af6e37d5db8d69c0cf /crypto/simd.c | |
| parent | crypto: hisilicon - Fix reference after free of memories on error path (diff) | |
| download | linux-dev-508a1c4df085a547187eed346f1bfe5e381797f1.tar.xz linux-dev-508a1c4df085a547187eed346f1bfe5e381797f1.zip | |
crypto: simd - correctly take reqsize of wrapped skcipher into account
The simd wrapper's skcipher request context structure consists
of a single subrequest whose size is taken from the subordinate
skcipher. However, in simd_skcipher_init(), the reqsize that is
retrieved is not from the subordinate skcipher but from the
cryptd request structure, whose size is completely unrelated to
the actual wrapped skcipher.
Reported-by: Qian Cai <cai@gmx.us>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Tested-by: Qian Cai <cai@gmx.us>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/simd.c')
| -rw-r--r-- | crypto/simd.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/crypto/simd.c b/crypto/simd.c index ea7240be3001..78e8d037ae2b 100644 --- a/crypto/simd.c +++ b/crypto/simd.c @@ -124,8 +124,9 @@ static int simd_skcipher_init(struct crypto_skcipher *tfm) ctx->cryptd_tfm = cryptd_tfm; - reqsize = sizeof(struct skcipher_request); - reqsize += crypto_skcipher_reqsize(&cryptd_tfm->base); + reqsize = crypto_skcipher_reqsize(cryptd_skcipher_child(cryptd_tfm)); + reqsize = max(reqsize, crypto_skcipher_reqsize(&cryptd_tfm->base)); + reqsize += sizeof(struct skcipher_request); crypto_skcipher_set_reqsize(tfm, reqsize); |