From 9770bb7d335f8f8db01e99168bbdd9ce2cb6238c Mon Sep 17 00:00:00 2001 From: Weili Qian Date: Fri, 18 Sep 2026 20:27:20 +0800 Subject: [PATCH] crypto: hisilicon/hpre - fix pointer dereference before length check In hpre_rsa_drop_leading_zeros(), the loop condition dereferences *ptr before checking *len, causing an out-of-bounds read when *len is zero. Swap to while (*len && !**ptr) to test length first. Fixes: c8b4b477079d ("crypto: hisilicon - add HiSilicon HPRE accelerator") Cc: stable@vger.kernel.org Signed-off-by: Weili Qian Signed-off-by: Herbert Xu --- drivers/crypto/hisilicon/hpre/hpre_crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c index 09077abbf6ad..7894211b9972 100644 --- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c +++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c @@ -720,7 +720,7 @@ static void hpre_dh_exit_tfm(struct crypto_kpp *tfm) static void hpre_rsa_drop_leading_zeros(const char **ptr, size_t *len) { - while (!**ptr && *len) { + while (*len && !**ptr) { (*ptr)++; (*len)--; }