crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()

Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way
it is done in tegra_ccm_crypt_init(). The current formulae may lead to a
crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize
remains zero. Then a decrypt operation with incorrect rctx->cryptlen will
lead to a write beyound rctx->dst_sg buffer.

As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since
it appears to be completely unused. Also simplify tegra_ccm_setauthsize()
and tegra_gcm_setauthsize() functions respectively.

Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver")
Signed-off-by: Vladislav Dronov <vdronov@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c
index 9094c03e991f654be484f204d9c0d3443cb67105..0fd1d70358996c1d24ff07005913fe631a52dedb 100644 (file)
--- a/drivers/crypto/tegra/tegra-se-aes.c
+++ b/drivers/crypto/tegra/tegra-se-aes.c
@@ -45,7 +45,6 @@ struct tegra_aes_reqctx {
 
 struct tegra_aead_ctx {
        struct tegra_se *se;
-       unsigned int authsize;
        u32 alg;
        u32 key_id;
        u32 keylen;
@@ -1290,7 +1289,7 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)
        if (rctx->encrypt)
                rctx->cryptlen = req->cryptlen;
        else
-               rctx->cryptlen = req->cryptlen - ctx->authsize;
+               rctx->cryptlen = req->cryptlen - rctx->authsize;
 
        memcpy(rctx->iv, req->iv, GCM_AES_IV_SIZE);
        rctx->iv[3] = (1 << 24);
@@ -1394,8 +1393,6 @@ static int tegra_aead_cra_init(struct crypto_aead *tfm)
 
 static int tegra_ccm_setauthsize(struct crypto_aead *tfm,  unsigned int authsize)
 {
-       struct tegra_aead_ctx *ctx = crypto_aead_ctx(tfm);
-
        switch (authsize) {
        case 4:
        case 6:
@@ -1404,28 +1401,15 @@ static int tegra_ccm_setauthsize(struct crypto_aead *tfm,  unsigned int authsize
        case 12:
        case 14:
        case 16:
-               break;
+               return 0;
        default:
                return -EINVAL;
        }
-
-       ctx->authsize = authsize;
-
-       return 0;
 }
 
 static int tegra_gcm_setauthsize(struct crypto_aead *tfm,  unsigned int authsize)
 {
-       struct tegra_aead_ctx *ctx = crypto_aead_ctx(tfm);
-       int ret;
-
-       ret = crypto_gcm_check_authsize(authsize);
-       if (ret)
-               return ret;
-
-       ctx->authsize = authsize;
-
-       return 0;
+       return crypto_gcm_check_authsize(authsize);
 }
 
 static void tegra_aead_cra_exit(struct crypto_aead *tfm)