Re: HIFN+IPsec crashes in current -git

[Evgeniy Polyakov]

On Thu, Feb 21, 2008 at 03:20:45PM +0100, Patrick McHardy ([EMAIL PROTECTED]) 
wrote:
> Almost I guess :) There are similar loops in hifn_setup_session().
> Additionally we need to check that the return value of ablkcipher_walk()
> is not a negative errno code.

Yep. Kind of this one:

diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
index dfbf24c..c88b4d9 100644
--- a/drivers/crypto/hifn_795x.c
+++ b/drivers/crypto/hifn_795x.c
@@ -1544,7 +1544,10 @@ static int ablkcipher_walk(struct ablkcipher_request 
*req,
 
                        kunmap_atomic(daddr, KM_SOFTIRQ0);
                } else {
-                       nbytes -= src->length;
+                       if (src->length >= nbytes)
+                               nbytes = 0;
+                       else
+                               nbytes -= src->length;
                        idx++;
                }
 
@@ -1588,7 +1591,10 @@ static int hifn_setup_session(struct ablkcipher_request 
*req)
                        ctx->walk.flags |= ASYNC_FLAGS_MISALIGNED;
                }
 
-               nbytes -= src->length;
+               if (src->length > nbytes)
+                       nbytes = 0;
+               else
+                       nbytes -= src->length;
                idx++;
        }
 
@@ -1602,6 +1608,10 @@ static int hifn_setup_session(struct ablkcipher_request 
*req)
        idx = 0;
 
        sg_num = ablkcipher_walk(req, &ctx->walk);
+       if (sg_num < 0) {
+               err = sg_num;
+               goto err_out_exit;
+       }
 
        atomic_set(&ctx->sg_num, sg_num);
 
@@ -1640,7 +1650,10 @@ static int hifn_setup_session(struct ablkcipher_request 
*req)
                if (err)
                        goto err_out;
 
-               nbytes -= len;
+               if (len > nbytes)
+                       nbytes = 0;
+               else
+                       nbytes -= len;
        }
 
        dev->active = HIFN_DEFAULT_ACTIVE_NUM;
@@ -1803,7 +1816,10 @@ static void hifn_process_ready(struct ablkcipher_request 
*req, int error)
                                        sg_page(dst), dst->length, nbytes);
 
                                if (!t->length) {
-                                       nbytes -= dst->length;
+                                       if (dst->length > nbytes)
+                                               nbytes = 0;
+                                       else
+                                               nbytes -= dst->length;
                                        idx++;
                                        continue;
                                }



-- 
        Evgeniy Polyakov
-
To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html