Skip to content
  • Steve Cornelius's avatar
    ENGR00215875-2: caam: fix descriptor buffer overrun in hash_digest_key() · c2fabda1
    Steve Cornelius authored
    
    
    HMAC keys often need to be reduced to under the size of a digest to
    be used. The driver does this psuedo-synchronously through the use of
    hash_digest_key(), which builds a sequence pointered job descriptor to
    perform this function.
    
    When this function built the job descriptor, it correctly accounted for the
    number of instructions and number of pointers that would go into its
    construction. However, it failed to account for the fact that both the
    sequence in and out pointers used extended lengths, adding 8 more bytes to
    the required job descriptor. This caused the descriptor to overrun the
    allocated buffer by that amount, resulting in memory corruptions.
    
    Signed-off-by: default avatarSteve Cornelius <steve.cornelius@freescale.com>
    Signed-off-by: default avatarTerry Lv <r65388@freescale.com>
    c2fabda1