[PATCH v2 3/7] crypto: ti - Fix potential memory corruption on highmem pages
From: T Pratham <t-pratham@ti.com>
Date: 2026-08-27 13:24:31
Also in:
lkml
Subsystem:
crypto api, the rest, ti data transform and hashing engine (dthe) v2 crypto driver · Maintainers:
Herbert Xu, "David S. Miller", Linus Torvalds, T Pratham
Change sg_set_buf to sg_set_page in DTHEv2 dthe_copy_sg function to
avoid using sg_virt() on scatterlists. For scatterlists containing a
highmem page, sg_virt() yields invalid or null adrdess, causing
potential memory corruption. While we are here, also change function
signature to change buflen from int to unsigned int.
Fixes: 35645ca63caa1 ("crypto: ti - Add support for AES-CTR in DTHEv2 driver")
Signed-off-by: T Pratham <t-pratham@ti.com>
---
drivers/crypto/ti/dthev2-common.c | 4 ++--
drivers/crypto/ti/dthev2-common.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/ti/dthev2-common.c b/drivers/crypto/ti/dthev2-common.c
index 4c6b72ba104ec..8628187a32e18 100644
--- a/drivers/crypto/ti/dthev2-common.c
+++ b/drivers/crypto/ti/dthev2-common.c@@ -50,7 +50,7 @@ struct dthe_data *dthe_get_dev(struct dthe_tfm_ctx *ctx) struct scatterlist *dthe_copy_sg(struct scatterlist *dst, struct scatterlist *src, - int buflen) + unsigned int buflen) { struct scatterlist *from_sg, *to_sg; int sglen;
@@ -59,7 +59,7 @@ struct scatterlist *dthe_copy_sg(struct scatterlist *dst, sglen = from_sg->length; if (sglen > buflen) sglen = buflen; - sg_set_buf(to_sg, sg_virt(from_sg), sglen); + sg_set_page(to_sg, sg_page(from_sg), sglen, from_sg->offset); from_sg = sg_next(from_sg); to_sg = sg_next(to_sg); }
diff --git a/drivers/crypto/ti/dthev2-common.h b/drivers/crypto/ti/dthev2-common.h
index d4a3b9c18bbc1..75d9a097650da 100644
--- a/drivers/crypto/ti/dthev2-common.h
+++ b/drivers/crypto/ti/dthev2-common.h@@ -126,7 +126,7 @@ struct dthe_data *dthe_get_dev(struct dthe_tfm_ctx *ctx); **/ struct scatterlist *dthe_copy_sg(struct scatterlist *dst, struct scatterlist *src, - int buflen); + unsigned int buflen); int dthe_register_aes_algs(void); void dthe_unregister_aes_algs(void);
--
2.34.1