crypto/qat: fix out-of-bounds access

[dpdk.git] / drivers / crypto / qat / qat_crypto.c

diff --git a/drivers/crypto/qat/qat_crypto.c b/drivers/crypto/qat/qat_crypto.c
index 6014841..9d8dc77 100644 (file)
--- a/drivers/crypto/qat/qat_crypto.c
+++ b/drivers/crypto/qat/qat_crypto.c
@@ -1,34 +1,5 @@
-/*-
- *   BSD LICENSE
- *
- *   Copyright(c) 2015-2017 Intel Corporation. All rights reserved.
- *   All rights reserved.
- *
- *   Redistribution and use in source and binary forms, with or without
- *   modification, are permitted provided that the following conditions
- *   are met:
- *
- *      * Redistributions of source code must retain the above copyright
- *        notice, this list of conditions and the following disclaimer.
- *      * Redistributions in binary form must reproduce the above copyright
- *        notice, this list of conditions and the following disclaimer in
- *        the documentation and/or other materials provided with the
- *        distribution.
- *      * Neither the name of Intel Corporation nor the names of its
- *        contributors may be used to endorse or promote products derived
- *        from this software without specific prior written permission.
- *
- *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+/* SPDX-License-Identifier: BSD-3-Clause
+ * Copyright(c) 2015-2017 Intel Corporation
  */
 
 #include <stdio.h>
@@ -69,6 +40,10 @@
 #include "adf_transport_access_macros.h"
 
 #define BYTE_LENGTH    8
+/* bpi is only used for partial blocks of DES and AES
+ * so AES block len can be assumed as max len for iv, src and dst
+ */
+#define BPI_MAX_ENCR_IV_LEN ICP_QAT_HW_AES_BLK_SZ
 
 static int
 qat_is_cipher_alg_supported(enum rte_crypto_cipher_algorithm algo,
@@ -121,16 +96,16 @@ bpi_cipher_encrypt(uint8_t *src, uint8_t *dst,
 {
        EVP_CIPHER_CTX *ctx = (EVP_CIPHER_CTX *)bpi_ctx;
        int encrypted_ivlen;
-       uint8_t encrypted_iv[16];
-       int i;
+       uint8_t encrypted_iv[BPI_MAX_ENCR_IV_LEN];
+       uint8_t *encr = encrypted_iv;
 
        /* ECB method: encrypt the IV, then XOR this with plaintext */
        if (EVP_EncryptUpdate(ctx, encrypted_iv, &encrypted_ivlen, iv, ivlen)
                                                                <= 0)
                goto cipher_encrypt_err;
 
-       for (i = 0; i < srclen; i++)
-               *(dst+i) = *(src+i)^(encrypted_iv[i]);
+       for (; srclen != 0; --srclen, ++dst, ++src, ++encr)
+               *dst = *src ^ *encr;
 
        return 0;
 
@@ -150,16 +125,16 @@ bpi_cipher_decrypt(uint8_t *src, uint8_t *dst,
 {
        EVP_CIPHER_CTX *ctx = (EVP_CIPHER_CTX *)bpi_ctx;
        int encrypted_ivlen;
-       uint8_t encrypted_iv[16];
-       int i;
+       uint8_t encrypted_iv[BPI_MAX_ENCR_IV_LEN];
+       uint8_t *encr = encrypted_iv;
 
        /* ECB method: encrypt (not decrypt!) the IV, then XOR with plaintext */
        if (EVP_EncryptUpdate(ctx, encrypted_iv, &encrypted_ivlen, iv, ivlen)
                                                                <= 0)
                goto cipher_decrypt_err;
 
-       for (i = 0; i < srclen; i++)
-               *(dst+i) = *(src+i)^(encrypted_iv[i]);
+       for (; srclen != 0; --srclen, ++dst, ++src, ++encr)
+               *dst = *src ^ *encr;
 
        return 0;
 
@@ -1376,7 +1351,7 @@ qat_write_hw_desc_entry(struct rte_crypto_op *op, uint8_t *out_msg,
                 * This address may used for setting AAD physical pointer
                 * into IV offset from op
                 */
-               phys_addr_t aad_phys_addr_aead = op->sym->aead.aad.phys_addr;
+               rte_iova_t aad_phys_addr_aead = op->sym->aead.aad.phys_addr;
                if (ctx->qat_hash_alg ==
                                ICP_QAT_HW_AUTH_ALGO_GALOIS_128 ||
                                ctx->qat_hash_alg ==