crypto: simd - correctly take reqsize of wrapped skcipher into account

The simd wrapper's skcipher request context structure consists of a single subrequest whose size is taken from the subordinate skcipher. However, in simd_skcipher_init(), the reqsize that is retrieved is not from the subordinate skcipher but from the cryptd request structure, whose size is completely unrelated to the actual wrapped skcipher. Reported-by: Qian Cai <[email protected]> Signed-off-by: Ard Biesheuvel <[email protected]> Tested-by: Qian Cai <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
broSysX64 · Nov 9, 2018 · 508a1c4 · 508a1c4
1 parent 0b0cf6a
commit 508a1c4
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/crypto/simd.c b/crypto/simd.c
@@ -124,8 +124,9 @@ static int simd_skcipher_init(struct crypto_skcipher *tfm)
 
 	ctx->cryptd_tfm = cryptd_tfm;
 
-	reqsize = sizeof(struct skcipher_request);
-	reqsize += crypto_skcipher_reqsize(&cryptd_tfm->base);
+	reqsize = crypto_skcipher_reqsize(cryptd_skcipher_child(cryptd_tfm));
+	reqsize = max(reqsize, crypto_skcipher_reqsize(&cryptd_tfm->base));
+	reqsize += sizeof(struct skcipher_request);
 
 	crypto_skcipher_set_reqsize(tfm, reqsize);