From: Kim Phillips Date: Thu, 26 May 2011 03:30:34 +0000 (+1000) Subject: crypto: caam - fix operator precedence in shared descriptor allocation X-Git-Tag: v4.13~14193^2 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=a18b989a5c12ca82ed37f94279273ddbc073758a;p=mirror_ubuntu-bionic-kernel.git crypto: caam - fix operator precedence in shared descriptor allocation setkey allocates 16 bytes (CAAM_CMD_SZ * DESC_AEAD_SHARED_TEXT_LEN) shy of what is needed to store the shared descriptor, resulting in memory corruption. Fix this. Signed-off-by: Kim Phillips Signed-off-by: Herbert Xu --- diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c index d0e65d6ddc77..676d957c22b0 100644 --- a/drivers/crypto/caam/caamalg.c +++ b/drivers/crypto/caam/caamalg.c @@ -238,9 +238,9 @@ static int build_sh_desc_ipsec(struct caam_ctx *ctx) /* build shared descriptor for this session */ sh_desc = kmalloc(CAAM_CMD_SZ * DESC_AEAD_SHARED_TEXT_LEN + - keys_fit_inline ? - ctx->split_key_pad_len + ctx->enckeylen : - CAAM_PTR_SZ * 2, GFP_DMA | GFP_KERNEL); + (keys_fit_inline ? + ctx->split_key_pad_len + ctx->enckeylen : + CAAM_PTR_SZ * 2), GFP_DMA | GFP_KERNEL); if (!sh_desc) { dev_err(jrdev, "could not allocate shared descriptor\n"); return -ENOMEM;