[lvc-project] [PATCH] crypto: keembay-ocs: prevent underflow in sg_data_total - remainder

[Dmitriy Okunev]

In the kmb_ocs_dma_prepare() function, the `remainder` is calculated
as `total % blk_sz`, where `total = sg_data_total + buf_cnt`. In
update requests, if `buf_cnt` is large and `total` is less than
`rctx->blk_sz`, the `remainder` may exceed `sg_data_total`, which
will lead to an overflow of `sg_data_total - remainder`. This results
in an incorrect large value being passed to the `sg_nents_for_len()`
function, which can lead to memory corruption.

Add a check to return -EINVAL if `sg_data_total < remainder`,
so that the subtraction is always safe.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver")
Signed-off-by: Dmitriy Okunev <dokunevdmitriy at gmail.com>
---
 drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
index 9a67bb4ecc82..92f2d9ff6f83 100644
--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
@@ -246,8 +246,11 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
 	 * HCU must be aligned to the block size; compute the remainder data to
 	 * be processed in the next request.
 	 */
-	if (!(rctx->flags & REQ_FINAL))
+	if (!(rctx->flags & REQ_FINAL)) {
 		remainder = total % rctx->blk_sz;
+		if (rctx->sg_data_total < remainder)
+			return -EINVAL;
+	}
 
 	/* Determine the number of scatter gather list entries to process. */
 	nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder);
-- 
2.53.0