mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-06 16:49:22 +00:00
crypto: qat - add param check for RSA
Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linear buffer. Cc: stable@vger.kernel.org Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Adam Guerin <adam.guerin@intel.com> Reviewed-by: Wojciech Ziemba <wojciech.ziemba@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
parent
029aa4624a
commit
9714061423
1 changed files with 8 additions and 0 deletions
|
@ -656,6 +656,10 @@ static int qat_rsa_enc(struct akcipher_request *req)
|
||||||
req->dst_len = ctx->key_sz;
|
req->dst_len = ctx->key_sz;
|
||||||
return -EOVERFLOW;
|
return -EOVERFLOW;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (req->src_len > ctx->key_sz)
|
||||||
|
return -EINVAL;
|
||||||
|
|
||||||
memset(msg, '\0', sizeof(*msg));
|
memset(msg, '\0', sizeof(*msg));
|
||||||
ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr,
|
ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr,
|
||||||
ICP_QAT_FW_COMN_REQ_FLAG_SET);
|
ICP_QAT_FW_COMN_REQ_FLAG_SET);
|
||||||
|
@ -785,6 +789,10 @@ static int qat_rsa_dec(struct akcipher_request *req)
|
||||||
req->dst_len = ctx->key_sz;
|
req->dst_len = ctx->key_sz;
|
||||||
return -EOVERFLOW;
|
return -EOVERFLOW;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (req->src_len > ctx->key_sz)
|
||||||
|
return -EINVAL;
|
||||||
|
|
||||||
memset(msg, '\0', sizeof(*msg));
|
memset(msg, '\0', sizeof(*msg));
|
||||||
ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr,
|
ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr,
|
||||||
ICP_QAT_FW_COMN_REQ_FLAG_SET);
|
ICP_QAT_FW_COMN_REQ_FLAG_SET);
|
||||||
|
|
Loading…
Reference in a new issue