Commit f173195e authored by Giovanni Cabiddu's avatar Giovanni Cabiddu Committed by Yifan Qiao
Browse files

crypto: qat - add param check for DH 

mainline inclusion
from mainline-v5.19-rc1
commit 2acbb877
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBP212
CVE: CVE-2022-49564

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2acbb8771f6ac82422886e63832ee7a0f4b1635b



--------------------------------

Reject requests with a source buffer that is bigger than the size of the
key. This is to prevent a possible integer underflow that might happen
when copying the source scatterlist into a linear buffer.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarGiovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: default avatarAdam Guerin <adam.guerin@intel.com>
Reviewed-by: default avatarWojciech Ziemba <wojciech.ziemba@intel.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarYifan Qiao <qiaoyifan4@huawei.com>
parent e3574c5c

drivers/crypto/qat/qat_common/qat_asym_algs.c

+4 −0
Original line number Diff line number Diff line
@@ -273,6 +273,10 @@ static int qat_dh_compute_value(struct kpp_request *req) 
		req->dst_len = ctx->p_size;

		return -EOVERFLOW;

	}



	if (req->src_len > ctx->p_size)

		return -EINVAL;



	memset(msg, '\0', sizeof(*msg));

	ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr,

					  ICP_QAT_FW_COMN_REQ_FLAG_SET);