[PATCH v3 08/12] crypto: ti - Validate sg_nents_for_len() return value in DTHEv2 AES
From: T Pratham <t-pratham@ti.com>
Date: 2026-09-10 10:43:11
Also in:
lkml
Subsystem:
crypto api, the rest, ti data transform and hashing engine (dthe) v2 crypto driver · Maintainers:
Herbert Xu, "David S. Miller", Linus Torvalds, T Pratham
sg_nents_for_len() returns -EINVAL if the supplied scatterlist is
shorter than the requested length.
Add explicit checks after each sg_nents_for_len() call in DTHEv2 AES
driver.
Fixes: 52f641bc63a46 ("crypto: ti - Add driver for DTHE V2 AES Engine (ECB, CBC)")
Signed-off-by: T Pratham <t-pratham@ti.com>
---
drivers/crypto/ti/dthev2-aes.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/crypto/ti/dthev2-aes.c b/drivers/crypto/ti/dthev2-aes.c
index aeccc235cb667..bc3591ec58a1c 100644
--- a/drivers/crypto/ti/dthev2-aes.c
+++ b/drivers/crypto/ti/dthev2-aes.c@@ -354,6 +354,11 @@ static int dthe_aes_run(struct crypto_engine *engine, void *areq) u32 aes_irqenable_val = readl_relaxed(aes_base_reg + DTHE_P_AES_IRQENABLE); u32 aes_sysconfig_val = readl_relaxed(aes_base_reg + DTHE_P_AES_SYSCONFIG); + if (src_nents < 0 || dst_nents < 0) { + ret = -EINVAL; + goto aes_inval_nent_err; + } + aes_sysconfig_val |= DTHE_AES_SYSCONFIG_DMA_DATA_IN_OUT_EN; writel_relaxed(aes_sysconfig_val, aes_base_reg + DTHE_P_AES_SYSCONFIG);
@@ -510,6 +515,7 @@ static int dthe_aes_run(struct crypto_engine *engine, void *areq) if (ret == -ENOMEM) ret = dthe_aes_do_fallback(req); +aes_inval_nent_err: local_bh_disable(); crypto_finalize_skcipher_request(dev_data->engine, req, ret); local_bh_enable();
--
2.34.1