diff mbox series

[v2] crypto/fsl: fsl_hash: Fix crash in flush dcache

Message ID 20220609124657.2444224-1-gaurav.jain@nxp.com
State Changes Requested
Delegated to: Stefano Babic
Headers show
Series [v2] crypto/fsl: fsl_hash: Fix crash in flush dcache | expand

Commit Message

Gaurav Jain June 9, 2022, 12:46 p.m. UTC 
wrong end address passed to flush_dcache_range.
modified the flush_dache logic for scatter list elements.

Fixes: 1919f58a8f (crypto/fsl: fsl_hash: Fix dcache issue in caam_hash_finish)
Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com>
---
 drivers/crypto/fsl/fsl_hash.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

Comments

Fabio Estevam June 14, 2022, 9:24 p.m. UTC | #1 
Hi Gaurav,

On Thu, Jun 9, 2022 at 9:47 AM Gaurav Jain <gaurav.jain@nxp.com> wrote:

> +       flush_dcache_range((ulong)ctx->sg_tbl,
> +                          (ulong)(ctx->sg_tbl) + (ctx->sg_num * sizeof(struct sg_entry)));
> +       for (i = 0; i < ctx->sg_num; i++) {
> +               sg_entry_len = (sec_in32(&ctx->sg_tbl[i].len_flag) &
> +                               SG_ENTRY_LENGTH_MASK);
> +               len += sg_entry_len;
> +               addr = sec_in32(&ctx->sg_tbl[i].addr_hi);
> +               addr = (addr << 32) | sec_in32(&ctx->sg_tbl[i].addr_lo);

This breaks the build:

arm: + ls1021aiot_qspi
1183+drivers/crypto/fsl/fsl_hash.c: In function 'caam_hash_finish':
1184+drivers/crypto/fsl/fsl_hash.c:150:30: error: left shift count >=
width of type [-Werror=shift-count-overflow]
1185+ 150 | addr = (addr << 32) | sec_in32(&ctx->sg_tbl[i].addr_lo);
1186+ | ^~
1187+cc1: all warnings being treated as errors

Please check:
https://source.denx.de/u-boot/custodians/u-boot-imx/-/jobs/448344
diff mbox series

Patch

diff --git a/drivers/crypto/fsl/fsl_hash.c b/drivers/crypto/fsl/fsl_hash.c
index 9e6829b7ad..c957f097f6 100644
--- a/drivers/crypto/fsl/fsl_hash.c
+++ b/drivers/crypto/fsl/fsl_hash.c
@@ -131,25 +131,31 @@  static int caam_hash_update(void *hash_ctx, const void *buf,
 static int caam_hash_finish(void *hash_ctx, void *dest_buf,
 			    int size, enum caam_hash_algos caam_algo)
 {
-	uint32_t len = 0;
+	uint32_t len = 0, sg_entry_len;
 	struct sha_ctx *ctx = hash_ctx;
 	int i = 0, ret = 0;
+	ulong addr;
 
 	if (size < driver_hash[caam_algo].digestsize) {
 		return -EINVAL;
 	}
 
-	for (i = 0; i < ctx->sg_num; i++)
-		len += (sec_in32(&ctx->sg_tbl[i].len_flag) &
-			SG_ENTRY_LENGTH_MASK);
-
+	flush_dcache_range((ulong)ctx->sg_tbl,
+			   (ulong)(ctx->sg_tbl) + (ctx->sg_num * sizeof(struct sg_entry)));
+	for (i = 0; i < ctx->sg_num; i++) {
+		sg_entry_len = (sec_in32(&ctx->sg_tbl[i].len_flag) &
+				SG_ENTRY_LENGTH_MASK);
+		len += sg_entry_len;
+		addr = sec_in32(&ctx->sg_tbl[i].addr_hi);
+		addr = (addr << 32) | sec_in32(&ctx->sg_tbl[i].addr_lo);
+		flush_dcache_range((ulong)addr, (ulong)addr + sg_entry_len);
+	}
 	inline_cnstr_jobdesc_hash(ctx->sha_desc, (uint8_t *)ctx->sg_tbl, len,
 				  ctx->hash,
 				  driver_hash[caam_algo].alg_type,
 				  driver_hash[caam_algo].digestsize,
 				  1);
 
-	flush_dcache_range((ulong)ctx->sg_tbl, (ulong)(ctx->sg_tbl) + len);
 	flush_dcache_range((ulong)ctx->sha_desc,
 			   (ulong)(ctx->sha_desc) + (sizeof(uint32_t) * MAX_CAAM_DESCSIZE));
 	flush_dcache_range((ulong)ctx->hash,