github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

crypto: qat - avoid OOB read when stripping RSA leading zeros

Browse Source 
The logical AND operator uses short-circuit evaluation: the first
operand is always evaluated, while the second is evaluated only if
the first is true. Because the first operand dereferences a pointer,
it may cause an out-of-bounds access before the bounds check in the
second operand is evaluated.

Resolve this by checking the vlen prior to the pointer being dereferenced.

Fixes: a990532023 ("crypto: qat - Add support for RSA algorithm")
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Ahsan Atta 2026-08-24 11:17:44 +01:00 committed by Herbert Xu
parent 6c2373dd81
commit ac50823889
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/crypto/intel/qat/qat_common/qat_asym_algs.c
View File

@ -987,7 +987,7 @@ static int qat_rsa_set_n(struct qat_rsa_ctx *ctx, const char *value,
const char *ptr = value;
int ret;
while (!*ptr && vlen) {
while (vlen && !*ptr) {
ptr++;
vlen--;
}
@ -1018,7 +1018,7 @@ static int qat_rsa_set_e(struct qat_rsa_ctx *ctx, const char *value,
struct device *dev = &GET_DEV(inst->accel_dev);
const char *ptr = value;
while (!*ptr && vlen) {
while (vlen && !*ptr) {
ptr++;
vlen--;
}
@ -1044,7 +1044,7 @@ static int qat_rsa_set_d(struct qat_rsa_ctx *ctx, const char *value,
const char *ptr = value;
int ret;
while (!*ptr && vlen) {
while (vlen && !*ptr) {
ptr++;
vlen--;
}
@ -1067,7 +1067,7 @@ static int qat_rsa_set_d(struct qat_rsa_ctx *ctx, const char *value,
static void qat_rsa_drop_leading_zeros(const char **ptr, unsigned int *len)
{
while (!**ptr && *len) {
while (*len && !**ptr) {
(*ptr)++;
(*len)--;
}