Commit 6e439bbd authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 

Pull crypto fixes from Herbert Xu:
 "This contains fixes for a resource leak in ccp as well as stack
  corruption in x86/sm4"

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: x86/sm4 - Fix frame pointer stack corruption
  crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
parents a4e6f95a 0e14ef38

arch/x86/crypto/sm4-aesni-avx-asm_64.S

+3 −2
Original line number Diff line number Diff line
@@ -367,10 +367,11 @@ SYM_FUNC_START(sm4_aesni_avx_crypt8) 
	 *	%rdx: src (1..8 blocks)

	 *	%rcx: num blocks (1..8)

	 */

	FRAME_BEGIN



	cmpq $5, %rcx;

	jb sm4_aesni_avx_crypt4;



	FRAME_BEGIN



	vmovdqu (0 * 16)(%rdx), RA0;

	vmovdqu (1 * 16)(%rdx), RA1;

	vmovdqu (2 * 16)(%rdx), RA2;

drivers/crypto/ccp/ccp-ops.c

+8 −6
Original line number Diff line number Diff line
@@ -778,7 +778,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) 
				    in_place ? DMA_BIDIRECTIONAL

					     : DMA_TO_DEVICE);

		if (ret)

			goto e_ctx;

			goto e_aad;



		if (in_place) {

			dst = src;
@@ -863,7 +863,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) 
	op.u.aes.size = 0;

	ret = cmd_q->ccp->vdata->perform->aes(&op);

	if (ret)

		goto e_dst;

		goto e_final_wa;



	if (aes->action == CCP_AES_ACTION_ENCRYPT) {

		/* Put the ciphered tag after the ciphertext. */
@@ -873,17 +873,19 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) 
		ret = ccp_init_dm_workarea(&tag, cmd_q, authsize,

					   DMA_BIDIRECTIONAL);

		if (ret)

			goto e_tag;

			goto e_final_wa;

		ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize);

		if (ret)

			goto e_tag;

		if (ret) {

			ccp_dm_free(&tag);

			goto e_final_wa;

		}



		ret = crypto_memneq(tag.address, final_wa.address,

				    authsize) ? -EBADMSG : 0;

		ccp_dm_free(&tag);

	}



e_tag:

e_final_wa:

	ccp_dm_free(&final_wa);



e_dst: