From patchwork Sat Jul 25 06:06:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yang Shen X-Patchwork-Id: 247144 Delivered-To: patch@linaro.org Received: by 2002:a92:d244:0:0:0:0:0 with SMTP id v4csp3077071ilg; Fri, 24 Jul 2020 23:09:42 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzSfftLajXrjqz/puAU0URWZxtkqGZk6IbPR2zsFzNLtiJkj4pCt2I0i49gLtln8lvgj9qE X-Received: by 2002:a17:906:3a0d:: with SMTP id z13mr12009132eje.109.1595657382697; Fri, 24 Jul 2020 23:09:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1595657382; cv=none; d=google.com; s=arc-20160816; b=OErueT1GCIBaFvgfm+4PrMN/RxLlPBgg6LkG5z592AWSoNDodT0ENBj0B6zmF3FnHS qxzADI55RQToDaAwiXtPI0sZkJWZPHwA5UWK8fA/uyN3z/zr5P7MZJCnepxE3fpEUFaQ OCHDcM86Dv2sHkY8GCCBZfa7glOJvUJL8LsTvahCd2tfNUOp/LUHAx5RbEnD6Al+l0RH N71+IwVP046DGf5F7FD/yPhlwG3fReS3y/6J/kYuN/vAz/J979VSHzgqC1sXETud74RC AAu4kXXxVAsIDoTBG6KXGo1fp+n4tDd94as5QOb63iRankAr2uiNUktFyB1C5/buauPN zDmA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from; bh=bayCkcOvnbG5BuyCu+s1L+KlVwQaZcMMfWZkee1nwr0=; b=vMTkYBp13vIAoUF05noAjSa8jEaavlwQnvutuJx9tKF+1QFGTeUyXF4ivbqb8nAPRq OYKmhhKeyu2GTt5TZUyRnMBPZRNbKeKLFUbzBbSNDKoV0x2tHZXg97mv2FAukkOI/idX fDChFqQjk3G0eABSbg30LFW+bPLFs3UwZevJHMZ+30uCB9Sy55zm3vgxwND5/l8v2/Sj GQk57NIdbo5qY0G+783oh/vGA3KRDuMNAYOAMkjCkKcACEI2dKpFszsU1bEOs3nZVbRD o/ig3Vk7I9+wgirGsXTYxdl+yaYOJIpprUISbl8LYfs9IUrtoaD3MOCPamgyZUMbns5Y H7IQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id n1si1846220ejc.134.2020.07.24.23.09.42; Fri, 24 Jul 2020 23:09:42 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726838AbgGYGJe (ORCPT + 2 others); Sat, 25 Jul 2020 02:09:34 -0400 Received: from szxga06-in.huawei.com ([45.249.212.32]:33160 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726777AbgGYGJd (ORCPT ); Sat, 25 Jul 2020 02:09:33 -0400 Received: from DGGEMS402-HUB.china.huawei.com (unknown [172.30.72.58]) by Forcepoint Email with ESMTP id 82BC68468E2EBB040554; Sat, 25 Jul 2020 14:09:28 +0800 (CST) Received: from localhost.localdomain (10.69.192.56) by DGGEMS402-HUB.china.huawei.com (10.3.19.202) with Microsoft SMTP Server id 14.3.487.0; Sat, 25 Jul 2020 14:09:21 +0800 From: Yang Shen To: , CC: , , , Subject: [PATCH 2/4] crypto: hisilicon/zip - fix zero length input in GZIP decompress Date: Sat, 25 Jul 2020 14:06:48 +0800 Message-ID: <1595657210-3964-3-git-send-email-shenyang39@huawei.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1595657210-3964-1-git-send-email-shenyang39@huawei.com> References: <1595657210-3964-1-git-send-email-shenyang39@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.69.192.56] X-CFilter-Loop: Reflected Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org From: Zhou Wang The zero length input will cause a call trace when use GZIP decompress like this: Unable to handle kernel paging request at virtual address ... lr : get_gzip_head_size+0x7c/0xd0 [hisi_zip] Judge the input length and return '-EINVAL' when input is invalid. Fixes: 62c455ca853e("crypto: hisilicon - add HiSilicon ZIP...") Signed-off-by: Zhou Wang Signed-off-by: Yang Shen --- drivers/crypto/hisilicon/zip/zip_crypto.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) -- 2.7.4 diff --git a/drivers/crypto/hisilicon/zip/zip_crypto.c b/drivers/crypto/hisilicon/zip/zip_crypto.c index 10b7adb..a1703eb 100644 --- a/drivers/crypto/hisilicon/zip/zip_crypto.c +++ b/drivers/crypto/hisilicon/zip/zip_crypto.c @@ -454,7 +454,7 @@ static int add_comp_head(struct scatterlist *dst, u8 req_type) return head_size; } -static size_t get_gzip_head_size(struct scatterlist *sgl) +static size_t __maybe_unused get_gzip_head_size(struct scatterlist *sgl) { char buf[HZIP_GZIP_HEAD_BUF]; @@ -463,13 +463,20 @@ static size_t get_gzip_head_size(struct scatterlist *sgl) return __get_gzip_head_size(buf); } -static size_t get_comp_head_size(struct scatterlist *src, u8 req_type) +static int get_comp_head_size(struct acomp_req *acomp_req, u8 req_type) { + if (!acomp_req->src || !acomp_req->slen) + return -EINVAL; + + if ((req_type == HZIP_ALG_TYPE_GZIP) && + (acomp_req->slen < GZIP_HEAD_FEXTRA_SHIFT)) + return -EINVAL; + switch (req_type) { case HZIP_ALG_TYPE_ZLIB: return TO_HEAD_SIZE(HZIP_ALG_TYPE_ZLIB); case HZIP_ALG_TYPE_GZIP: - return get_gzip_head_size(src); + return TO_HEAD_SIZE(HZIP_ALG_TYPE_GZIP); default: pr_err("Request type does not support!\n"); return -EINVAL; @@ -609,10 +616,15 @@ static int hisi_zip_adecompress(struct acomp_req *acomp_req) struct hisi_zip_qp_ctx *qp_ctx = &ctx->qp_ctx[HZIP_QPC_DECOMP]; struct device *dev = &qp_ctx->qp->qm->pdev->dev; struct hisi_zip_req *req; - size_t head_size; + int head_size; int ret; - head_size = get_comp_head_size(acomp_req->src, qp_ctx->qp->req_type); + head_size = get_comp_head_size(acomp_req, qp_ctx->qp->req_type); + if (head_size < 0) { + dev_err_ratelimited(dev, "Get comp head size failed (%d)!\n", + head_size); + return head_size; + } req = hisi_zip_create_req(acomp_req, qp_ctx, head_size, false); if (IS_ERR(req)) {