jsauer/torvalds-linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-01-11 17:10:13 +00:00
Code

This push contains the following changes:

Browse Source 
- Fix UAF in seqiv.
 - Fix regression in hisilicon.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmlRy74ACgkQxycdCkmx
 i6c72BAAhTJWUYKnI3KW65wCLObVR10AL5Hp/kYTRE2eOwkmnNXjlJVe80mnPhaU
 K64l0wsAKCkMjw3O0/KXH3nxqXN0+f67r5FZY07GJBj2yIQzTON2X1DxNcJ3DaUY
 CWEHJXtjipZu9f23K4fuHUQ5jxcvkigrH8Z5cfJ6I/KD/NpsbXUunEnkfV9QTDnX
 BKVEu7t9hdFX0OTLWTFUIAAlnS3Onu67F2uD1voLujBG+2aUNjuIk6ToAjKPTiam
 u03YigOsTsZBOgjM4O60rX33X/XJan2uNTkmvQQIUXWDB0ZvDvvXGZbxayEZXnSJ
 exWWv81uL4jAV76CYWSka8ILxdsqAIjlESnm8Vjn3YuVvEwQoI9Lvpyje64xv1ZR
 MqjfLXKrczu0NgKqP9GN9CqB3Yp6KxX7Xe+U7o+b1X/SSevoyhh18oMF1c4s9dfg
 6IqgK8byLZrge2Shpl7GsT21X9lQ9f/poUvbX9eNoyDn/EeqliR1i+4ydgaCW5Rx
 mK0UDwOpCxCAwd1H02Hy7bExAZnGwKXFsJJHSeHk/9y6gPmht+B4b5tGgDnkTCeu
 od6RXuAwKN+LKhNAybZSw1leEkvD48xggvRFtXg56nsqT4adbgL0QOPB3/iF01gt
 5LQu3I9vc4cjPj6Sx/tpTpkvyBog2C/sYMuHTl70UwpnloDcaKA=
 =vH+M
 -----END PGP SIGNATURE-----

Merge tag 'v6.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:

 - Fix UAF in seqiv

 - Fix regression in hisilicon

* tag 'v6.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: hisilicon/qm - fix incorrect judgment in qm_get_complete_eqe_num()
  crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
This commit is contained in:
Linus Torvalds 2025-12-28 16:55:16 -08:00
commit a69eddfd17
2 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
crypto/seqiv.c
View File

@ -50,6 +50,7 @@ static int seqiv_aead_encrypt(struct aead_request *req)
struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
struct aead_request *subreq = aead_request_ctx(req);
crypto_completion_t compl;
bool unaligned_info;
void *data;
u8 *info;
unsigned int ivsize = 8;
@ -68,8 +69,9 @@ static int seqiv_aead_encrypt(struct aead_request *req)
memcpy_sglist(req->dst, req->src,
req->assoclen + req->cryptlen);
if (unlikely(!IS_ALIGNED((unsigned long)info,
crypto_aead_alignmask(geniv) + 1))) {
unaligned_info = !IS_ALIGNED((unsigned long)info,
crypto_aead_alignmask(geniv) + 1);
if (unlikely(unaligned_info)) {
info = kmemdup(req->iv, ivsize, req->base.flags &
CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL :
GFP_ATOMIC);
@ -89,7 +91,7 @@ static int seqiv_aead_encrypt(struct aead_request *req)
scatterwalk_map_and_copy(info, req->dst, req->assoclen, ivsize, 1);
err = crypto_aead_encrypt(subreq);
if (unlikely(info != req->iv))
if (unlikely(unaligned_info))
seqiv_aead_encrypt_complete2(req, err);
return err;
}

9
drivers/crypto/hisilicon/qm.c
View File

@ -991,7 +991,7 @@ static void qm_get_complete_eqe_num(struct hisi_qm *qm)
return;
poll_data = &qm->poll_data[cqn];
while (QM_EQE_PHASE(dw0) != qm->status.eqc_phase) {
do {
poll_data->qp_finish_id[eqe_num] = dw0 & QM_EQE_CQN_MASK;
eqe_num++;
@ -1004,11 +1004,10 @@ static void qm_get_complete_eqe_num(struct hisi_qm *qm)
qm->status.eq_head++;
}
if (eqe_num == (eq_depth >> 1) - 1)
break;
dw0 = le32_to_cpu(eqe->dw0);
}
if (QM_EQE_PHASE(dw0) != qm->status.eqc_phase)
break;
} while (eqe_num < (eq_depth >> 1) - 1);
poll_data->eqe_num = eqe_num;
queue_work(qm->wq, &poll_data->work);