[PATCH v4 15/15] crypto: ti - Change lengths in AEAD to u64 to avoid potential overflows
From: T Pratham <t-pratham@ti.com>
Date: 2026-09-10 17:57:49
Also in:
lkml
Subsystem:
crypto api, the rest, ti data transform and hashing engine (dthe) v2 crypto driver · Maintainers:
Herbert Xu, "David S. Miller", Linus Torvalds, T Pratham
Change assoclen, cryptlen, authsize from unsigned int to u64 to avoid
overflow when they are added (in TAG offset and padding length
calculation)
Fixes: 37b902c603042 ("crypto: ti - Add support for AES-GCM in DTHEv2 driver")
Signed-off-by: T Pratham <t-pratham@ti.com>
---
drivers/crypto/ti/dthev2-aes.c | 28 +++++++++++++++++-----------
1 file changed, 17 insertions(+), 11 deletions(-)
diff --git a/drivers/crypto/ti/dthev2-aes.c b/drivers/crypto/ti/dthev2-aes.c
index 9b982ca4a7730..ca87aacc39c5d 100644
--- a/drivers/crypto/ti/dthev2-aes.c
+++ b/drivers/crypto/ti/dthev2-aes.c@@ -756,6 +756,9 @@ static int dthe_aead_enc_get_tag(struct aead_request *req) struct dthe_tfm_ctx *ctx = crypto_aead_ctx(crypto_aead_reqtfm(req)); struct dthe_aes_req_ctx *rctx = aead_request_ctx(req); u32 tag[AES_BLOCK_WORDS]; + u64 assoclen = req->assoclen; + u64 cryptlen = req->cryptlen; + u64 authsize = ctx->authsize; int nents; int ret;
@@ -763,12 +766,12 @@ static int dthe_aead_enc_get_tag(struct aead_request *req) if (ret) return ret; - nents = sg_nents_for_len(req->dst, req->cryptlen + req->assoclen + ctx->authsize); + nents = sg_nents_for_len(req->dst, cryptlen + assoclen + authsize); if (nents < 0) return nents; - sg_pcopy_from_buffer(req->dst, nents, tag, ctx->authsize, - req->assoclen + req->cryptlen); + sg_pcopy_from_buffer(req->dst, nents, tag, authsize, + assoclen + cryptlen); return 0; }
@@ -779,6 +782,9 @@ static int dthe_aead_dec_verify_tag(struct aead_request *req) struct dthe_aes_req_ctx *rctx = aead_request_ctx(req); u32 tag_out[AES_BLOCK_WORDS]; u32 tag_in[AES_BLOCK_WORDS]; + u64 assoclen = req->assoclen; + u64 cryptlen = req->cryptlen; + u64 authsize = ctx->authsize; int nents; int ret;
@@ -786,14 +792,14 @@ static int dthe_aead_dec_verify_tag(struct aead_request *req) if (ret) return ret; - nents = sg_nents_for_len(req->src, req->assoclen + req->cryptlen); + nents = sg_nents_for_len(req->src, assoclen + cryptlen); if (nents < 0) return nents; - sg_pcopy_to_buffer(req->src, nents, tag_in, ctx->authsize, - req->assoclen + req->cryptlen - ctx->authsize); + sg_pcopy_to_buffer(req->src, nents, tag_in, authsize, + assoclen + cryptlen - authsize); - if (crypto_memneq(tag_in, tag_out, ctx->authsize)) + if (crypto_memneq(tag_in, tag_out, authsize)) return -EBADMSG; else return 0;
@@ -887,10 +893,10 @@ static int dthe_aead_run(struct crypto_engine *engine, void *areq) struct dthe_aes_req_ctx *rctx = aead_request_ctx(req); struct dthe_data *dev_data = rctx->dev_data; - unsigned int cryptlen = req->cryptlen; - unsigned int assoclen = req->assoclen; - unsigned int authsize = ctx->authsize; - unsigned int unpadded_cryptlen; + u64 cryptlen = req->cryptlen; + u64 assoclen = req->assoclen; + u64 authsize = ctx->authsize; + u64 unpadded_cryptlen; struct scatterlist *src = NULL; struct scatterlist *dst = NULL; struct scatterlist *aad_sg = NULL;
--
2.34.1