crypto: starfive - Correctly handle return of sg_nents_for_len

The return value of sg_nents_for_len was assigned to an unsigned long
in starfive_hash_digest, causing negative error codes to be converted
to large positive integers.

Add error checking for sg_nents_for_len and return immediately on
failure to prevent potential buffer overflows.

Fixes: 7883d1b28a2b ("crypto: starfive - Add hash and HMAC support")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/drivers/crypto/starfive/jh7110-hash.c b/drivers/crypto/starfive/jh7110-hash.c
index e6839c7bfb73accc09609ecf5e6adbc4113a0b6a..54b7af4a7aee8239aa50c315361c3e332579ded9 100644 (file)
--- a/drivers/crypto/starfive/jh7110-hash.c
+++ b/drivers/crypto/starfive/jh7110-hash.c
@@ -325,6 +325,7 @@ static int starfive_hash_digest(struct ahash_request *req)
        struct starfive_cryp_ctx *ctx = crypto_ahash_ctx(tfm);
        struct starfive_cryp_request_ctx *rctx = ahash_request_ctx(req);
        struct starfive_cryp_dev *cryp = ctx->cryp;
+       int sg_len;
 
        memset(rctx, 0, sizeof(struct starfive_cryp_request_ctx));
 
@@ -333,7 +334,10 @@ static int starfive_hash_digest(struct ahash_request *req)
        rctx->in_sg = req->src;
        rctx->blksize = crypto_tfm_alg_blocksize(crypto_ahash_tfm(tfm));
        rctx->digsize = crypto_ahash_digestsize(tfm);
-       rctx->in_sg_len = sg_nents_for_len(rctx->in_sg, rctx->total);
+       sg_len = sg_nents_for_len(rctx->in_sg, rctx->total);
+       if (sg_len < 0)
+               return sg_len;
+       rctx->in_sg_len = sg_len;
        ctx->rctx = rctx;
 
        return crypto_transfer_hash_request_to_engine(cryp->engine, req);