On Fri, 2016-10-14 at 09:47 +0100, Ard Biesheuvel wrote:

Do you have a reference for the sg_set_buf() call on odata?
crypto/ccm.c does not seem to have it (afaict), 

It's indirect - crypto_ccm_encrypt() calls crypto_ccm_init_crypt()
which does it.

and the same problem
does not exist in the accelerated arm64 implementation. In the mean
time, I will try and see if we can move aad[] off the stack in the
WPA code.

I had that with per-CPU buffers, just sent the patch upthread.

johannes