[patch] crypto: nx - off by one bug in nx_of_update_msc()
From: Dan Carpenter <hidden>
Date: 2016-07-15 11:10:08
Also in:
kernel-janitors, linux-crypto
Subsystem:
crypto api, ibm power in-nest crypto acceleration, linux for powerpc (32-bit and 64-bit), the rest · Maintainers:
Herbert Xu, "David S. Miller", Breno Leitão, Nayna Jain, Paulo Flabiano Smorigo, Madhavan Srinivasan, Linus Torvalds
The props->ap[] array is defined like this:
struct alg_props ap[NX_MAX_FC][NX_MAX_MODE][3];
So we can see that if msc->fc and msc->mode are == to NX_MAX_FC or
NX_MAX_MODE then we're off by one.
Fixes: ae0222b7289d ('powerpc/crypto: nx driver code supporting nx encryption')
Signed-off-by: Dan Carpenter <redacted>
diff --git a/drivers/crypto/nx/nx.c b/drivers/crypto/nx/nx.c
index 0794f1c..42f0f22 100644
--- a/drivers/crypto/nx/nx.c
+++ b/drivers/crypto/nx/nx.c@@ -392,7 +392,7 @@ static void nx_of_update_msc(struct device *dev, ((bytes_so_far + sizeof(struct msc_triplet)) <= lenp) && i < msc->triplets; i++) { - if (msc->fc > NX_MAX_FC || msc->mode > NX_MAX_MODE) { + if (msc->fc >= NX_MAX_FC || msc->mode >= NX_MAX_MODE) { dev_err(dev, "unknown function code/mode " "combo: %d/%d (ignored)\n", msc->fc, msc->mode);