From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/crypto/qce/common.c:293 qce_xts_swapiv() error: buffer overflow 'swap' 16 <= 31
Date: Thu, 23 Apr 2026 01:51:49 +0800 [thread overview]
Message-ID: <202604230104.wmPWNBf3-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Thorsten Blum <thorsten.blum@linux.dev>
CC: Herbert Xu <herbert@gondor.apana.org.au>
CC: Bjorn Andersson <andersson@kernel.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 6596a02b207886e9e00bb0161c7fd59fea53c081
commit: 3787fb7697a942baa25361bfc3390575e5659db8 crypto: qce - simplify qce_xts_swapiv()
date: 10 days ago
:::::: branch date: 17 hours ago
:::::: commit date: 10 days ago
config: parisc-randconfig-r073-20260422 (https://download.01.org/0day-ci/archive/20260423/202604230104.wmPWNBf3-lkp@intel.com/config)
compiler: hppa-linux-gcc (GCC) 10.5.0
smatch: v0.5.0-9007-gcf3ea02b
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 3787fb7697a9 ("crypto: qce - simplify qce_xts_swapiv()")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202604230104.wmPWNBf3-lkp@intel.com/
smatch warnings:
drivers/crypto/qce/common.c:293 qce_xts_swapiv() error: buffer overflow 'swap' 16 <= 31
vim +/swap +293 drivers/crypto/qce/common.c
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 279
db0018a8b615e25 Thara Gopinath 2021-04-29 280 #ifdef CONFIG_CRYPTO_DEV_QCE_SKCIPHER
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 281 static void qce_xts_swapiv(__be32 *dst, const u8 *src, unsigned int ivsize)
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 282 {
3787fb7697a942b Thorsten Blum 2026-03-30 283 u8 swap[QCE_AES_IV_LENGTH] = {0};
3787fb7697a942b Thorsten Blum 2026-03-30 284 unsigned int i, offset;
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 285
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 286 if (ivsize > QCE_AES_IV_LENGTH)
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 287 return;
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 288
3787fb7697a942b Thorsten Blum 2026-03-30 289 offset = QCE_AES_IV_LENGTH - ivsize;
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 290
3787fb7697a942b Thorsten Blum 2026-03-30 291 /* Reverse and right-align IV bytes. */
3787fb7697a942b Thorsten Blum 2026-03-30 292 for (i = 0; i < ivsize; i++)
3787fb7697a942b Thorsten Blum 2026-03-30 @293 swap[offset + i] = src[ivsize - 1 - i];
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 294
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 295 qce_cpu_to_be32p_array(dst, swap, QCE_AES_IV_LENGTH);
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 296 }
59e056cda4beb54 Eneas U de Queiroz 2019-12-20 297
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-04-22 17:52 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-22 17:51 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-08-10 19:25 drivers/crypto/qce/common.c:293 qce_xts_swapiv() error: buffer overflow 'swap' 16 <= 31 kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202604230104.wmPWNBf3-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.