sg_nents_for_len() returns -EINVAL if the supplied scatterlist is
shorter than the requested length.
Add explicit checks after each sg_nents_for_len() call in DTHEv2 AES
driver.
Fixes: 52f641bc63a46 ("crypto: ti - Add driver for DTHE V2 AES Engine (ECB, CBC)")
Signed-off-by: T Pratham <t-pratham@ti.com>
---
drivers/crypto/ti/dthev2-aes.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/crypto/ti/dthev2-aes.c b/drivers/crypto/ti/dthev2-aes.c
index aeccc235cb667..bc3591ec58a1c 100644
--- a/drivers/crypto/ti/dthev2-aes.c
+++ b/drivers/crypto/ti/dthev2-aes.c
@@ -354,6 +354,11 @@ static int dthe_aes_run(struct crypto_engine *engine, void *areq)
u32 aes_irqenable_val = readl_relaxed(aes_base_reg + DTHE_P_AES_IRQENABLE);
u32 aes_sysconfig_val = readl_relaxed(aes_base_reg + DTHE_P_AES_SYSCONFIG);
+ if (src_nents < 0 || dst_nents < 0) {
+ ret = -EINVAL;
+ goto aes_inval_nent_err;
+ }
+
aes_sysconfig_val |= DTHE_AES_SYSCONFIG_DMA_DATA_IN_OUT_EN;
writel_relaxed(aes_sysconfig_val, aes_base_reg + DTHE_P_AES_SYSCONFIG);
@@ -510,6 +515,7 @@ static int dthe_aes_run(struct crypto_engine *engine, void *areq)
if (ret == -ENOMEM)
ret = dthe_aes_do_fallback(req);
+aes_inval_nent_err:
local_bh_disable();
crypto_finalize_skcipher_request(dev_data->engine, req, ret);
local_bh_enable();
--
2.34.1