提交 12cd4ab4 编写于 作者: Y Yu'an Wang 提交者: Yang Yingliang

crypto: hisilicon-Cap block size at 2^31

hulk inclusion
category: Feature
bugzilla: NA
CVE: NA

The function hisi_acc_create_sg_pool may allocate a block of
memory of size PAGE_SIZE * 2^(MAX_ORDER - 1).  This value may
exceed 2^31 on ia64, which would overflow the u32.
This patch caps it at 2^31.
Signed-off-by: NYu'an Wang <wangyuan46@huawei.com>
Signed-off-by: NZibo Xu <xuzaibo@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
上级 c113eec0
...@@ -9,6 +9,7 @@ ...@@ -9,6 +9,7 @@
#define HISI_ACC_SGL_NR_MAX 256 #define HISI_ACC_SGL_NR_MAX 256
#define HISI_ACC_SGL_ALIGN_SIZE 64 #define HISI_ACC_SGL_ALIGN_SIZE 64
#define HISI_ACC_MEM_BLOCK_NR 5 #define HISI_ACC_MEM_BLOCK_NR 5
#define HISI_ACC_BLOCK_SIZE_MAX_SHIFT 31
struct acc_hw_sge { struct acc_hw_sge {
dma_addr_t buf; dma_addr_t buf;
...@@ -66,7 +67,9 @@ struct hisi_acc_sgl_pool *hisi_acc_create_sgl_pool(struct device *dev, ...@@ -66,7 +67,9 @@ struct hisi_acc_sgl_pool *hisi_acc_create_sgl_pool(struct device *dev,
sgl_size = sizeof(struct acc_hw_sge) * sge_nr + sgl_size = sizeof(struct acc_hw_sge) * sge_nr +
sizeof(struct hisi_acc_hw_sgl); sizeof(struct hisi_acc_hw_sgl);
block_size = PAGE_SIZE * (1 << (MAX_ORDER - 1)); block_size = 1 << (PAGE_SHIFT + MAX_ORDER <= 32 ?
PAGE_SHIFT + MAX_ORDER - 1 :
HISI_ACC_BLOCK_SIZE_MAX_SHIFT);
sgl_num_per_block = block_size / sgl_size; sgl_num_per_block = block_size / sgl_size;
block_num = count / sgl_num_per_block; block_num = count / sgl_num_per_block;
remain_sgl = count % sgl_num_per_block; remain_sgl = count % sgl_num_per_block;
...@@ -230,6 +233,7 @@ hisi_acc_sg_buf_map_to_hw_sgl(struct device *dev, ...@@ -230,6 +233,7 @@ hisi_acc_sg_buf_map_to_hw_sgl(struct device *dev,
dma_unmap_sg(dev, sgl, sg_n, DMA_BIDIRECTIONAL); dma_unmap_sg(dev, sgl, sg_n, DMA_BIDIRECTIONAL);
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
} }
curr_hw_sgl->entry_length_in_sgl = cpu_to_le16(pool->sge_nr); curr_hw_sgl->entry_length_in_sgl = cpu_to_le16(pool->sge_nr);
curr_hw_sge = curr_hw_sgl->sge_entries; curr_hw_sge = curr_hw_sgl->sge_entries;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册