From 4fa9948ca5bf308fabd5c9b584bf710f5d393859 Mon Sep 17 00:00:00 2001 From: LABBE Corentin Date: Wed, 4 Nov 2015 21:13:36 +0100 Subject: [PATCH] crypto: qce - check return value of sg_nents_for_len The sg_nents_for_len() function could fail, this patch add a check for its return value. Signed-off-by: LABBE Corentin Signed-off-by: Herbert Xu --- drivers/crypto/qce/ablkcipher.c | 8 ++++++++ drivers/crypto/qce/sha.c | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/drivers/crypto/qce/ablkcipher.c b/drivers/crypto/qce/ablkcipher.c index 2c0d63d48747..dbcbbe242bd6 100644 --- a/drivers/crypto/qce/ablkcipher.c +++ b/drivers/crypto/qce/ablkcipher.c @@ -83,6 +83,14 @@ qce_ablkcipher_async_req_handle(struct crypto_async_request *async_req) rctx->dst_nents = sg_nents_for_len(req->dst, req->nbytes); else rctx->dst_nents = rctx->src_nents; + if (rctx->src_nents < 0) { + dev_err(qce->dev, "Invalid numbers of src SG.\n"); + return rctx->src_nents; + } + if (rctx->dst_nents < 0) { + dev_err(qce->dev, "Invalid numbers of dst SG.\n"); + return -rctx->dst_nents; + } rctx->dst_nents += 1; diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c index 0c9973ec80eb..47e114ac09d0 100644 --- a/drivers/crypto/qce/sha.c +++ b/drivers/crypto/qce/sha.c @@ -92,6 +92,11 @@ static int qce_ahash_async_req_handle(struct crypto_async_request *async_req) } rctx->src_nents = sg_nents_for_len(req->src, req->nbytes); + if (rctx->src_nents < 0) { + dev_err(qce->dev, "Invalid numbers of src SG.\n"); + return rctx->src_nents; + } + ret = dma_map_sg(qce->dev, req->src, rctx->src_nents, DMA_TO_DEVICE); if (ret < 0) return ret; -- 2.20.1