From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Thorsten Blum <thorsten.blum@linux.dev>,
Frank Li <Frank.Li@nxp.com>,
Herbert Xu <herbert@gondor.apana.org.au>
Subject: [PATCH 7.1 64/76] crypto: mxs-dcp - fix source scatterlist length access
Date: Mon, 31 Aug 2026 15:34:36 +0200 [thread overview]
Message-ID: <20260831133402.739254064@linuxfoundation.org> (raw)
In-Reply-To: <20260831133359.185608553@linuxfoundation.org>
7.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit c5bcb084a9871e5b62afb5f48b60adfa13b5d9f8 upstream.
mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source
scatterlist with dma_map_sg() first. Therefore, sg_dma_len() is invalid
and could return zero or a stale DMA length, causing encryption and
decryption to process the wrong number of bytes when
CONFIG_NEED_SG_DMA_LENGTH=y.
Use the original scatterlist length instead.
Fixes: 15b59e7c3733 ("crypto: mxs - Add Freescale MXS DCP driver")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/mxs-dcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/crypto/mxs-dcp.c
+++ b/drivers/crypto/mxs-dcp.c
@@ -353,7 +353,7 @@ static int mxs_dcp_aes_block_crypt(struc
for_each_sg(req->src, src, sg_nents(req->src), i) {
src_buf = sg_virt(src);
- len = sg_dma_len(src);
+ len = src->length;
tlen += len;
limit_hit = tlen > req->cryptlen;
next prev parent reply other threads:[~2026-08-31 13:44 UTC|newest]
Thread overview: 85+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-31 13:33 [PATCH 7.1 00/76] 7.1.13-rc1 review Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 01/76] bpf: reject overlarge global subprog argument sizes Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 02/76] RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 03/76] RDMA/rxe: Fix OOB in free_rd_atomic_resources() Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 04/76] KVM: x86/mmu: Check write tracking in all address spaces Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 05/76] nvme-tcp: fix usage of page_frag_cache Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 06/76] Revert "selinux: reject a permission value exceeding the class permission count" Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 07/76] selinux: use u16 for security classes Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 08/76] selinux: more strict policy parsing Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 09/76] selinux: reject a permission value exceeding the class permission count Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 10/76] selinux: require a classs permission values to cover its " Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 11/76] selinux: switch two allocations to use kzalloc_objs() Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 12/76] ext4: export converted block count from ext4_convert_unwritten_extents() Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 13/76] ext4: protect WRITE_ZEROES written extents with orphan list Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 14/76] ext4: move partial block zeroing earlier in ext4_zero_range() Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 15/76] ext4: write back partial-zeroed edges in WRITE_ZEROES Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 16/76] ext4: track partial-zero outcome per edge in ext4_zero_partial_blocks() Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 17/76] ext4: zero out whole block for clean edges in WRITE_ZEROES Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 18/76] fpga: dfl: fme: add error handling Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 19/76] accessibility: speakup: unregister tty ldisc on later init failures Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 20/76] usb: xhci: Handle bogus TRB pointers in Missed Service Error events Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 21/76] usb: xhci: Handle USB3 port events when there is one roothub Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 22/76] usb: xhci: bail out of setup if the controller is inaccessible Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 23/76] xhci: dbgtty: Fix unregister on tty_register_driver() failure Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 24/76] xhci: dbgtty: Fix unregister on tty_alloc_driver() failure Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 25/76] fuse: fix invalidate lock leak on setattr writeback failure Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 26/76] fuse: fix invalidate lock leak on open O_TRUNC DAX failure Greg Kroah-Hartman
2026-08-31 13:33 ` [PATCH 7.1 27/76] usb: usbtest: disable dynamic ID support Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 28/76] usb: gadget: f_tcm: keep port count until LUN teardown completes Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 29/76] KVM: SEV: Drop FOLL_WRITE for encrypted region registration Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 30/76] KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 31/76] KVM: SEV: Extract loading of guest-provided VMSA to a separate helper Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 32/76] KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 33/76] KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 34/76] tls: device: fix out-of-bounds write in tls_append_frag() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 35/76] gtp: serialize PDP context updates Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 36/76] net/tcp: fix TCP-AO key deletion in VRFs Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 37/76] tcp: fix AO info use-after-free in tcp_ao_connect_init() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 38/76] net/tcp-ao: fix use-after-free of current_key on reconnect to another peer Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 39/76] net: advertise TCP MSS from the configured MTU, not the learned PMTU Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 40/76] xfrm: espintcp: fix UAF during close Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 41/76] tcp: clamp route advmss to TCP_MIN_MSS Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 42/76] xfrm: drop ESP-in-TCP packets with no ingress device Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 43/76] xfrm: avoid lock inversion in nat keepalive work Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 44/76] xfrm: ah6: validate routing header segments_left Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 45/76] xfrm: fix xfrm_state_construct() auth-trunc leak Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 46/76] xfrm: bound nat keepalive state collection Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 47/76] net: bridge: mcast: fix use-after-free of a master VLANs multicast context Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 48/76] net/packet: defer vmalloc TX_RING free until skbs finish Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 49/76] ipv6: seg6: clear IPv4 control block on IPIP decapsulation Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 50/76] batman-adv: reject unrepresentable multicast TVLV offsets Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 51/76] vxlan: keep the last remote linked during FDB flush Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 52/76] netfilter: nft_set_pipapo_avx2: add missing vzeroupper Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 53/76] netfilter: nf_tables: dont queue packet path object notifications Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 54/76] mm/swap: reject swapon() on filesystem-level encrypted files Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 55/76] kunit: irq: Continue increasing hrtimer interval for longer Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 56/76] crypto: virtio - bound the akcipher result length Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 57/76] crypto: qcom-rng - Enable clock in hwrng case Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 58/76] crypto: qcom-rng - Remove crypto_rng interface Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 59/76] crypto: qcom-rng - Allow zero as a random number Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 60/76] crypto: atmel-tdes - use scatterlist length before DMA mapping Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 61/76] crypto: krb5 - use kfree_sensitive() for derived key buffers Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 62/76] crypto: qce - fix CCM AAD buffer underallocation Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 63/76] crypto: iaa - fall back to software for multi-entry scatterlists Greg Kroah-Hartman
2026-08-31 13:34 ` Greg Kroah-Hartman [this message]
2026-08-31 13:34 ` [PATCH 7.1 65/76] crypto: qce - Remove unsafe/deprecated algorithms Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 66/76] KVM: s390: vsie: zero stale crypto bits Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 67/76] usb: core: Add lock to usb_wakeup_notification() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 68/76] usb: core: Strengthen error handling in hub_hub_status() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 69/76] ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 70/76] ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 71/76] ALSA: usb-audio: Complete cleanup after system-resume errors Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 72/76] USB: serial: option: fix slab OOB read in interrupt URB callback Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 73/76] USB: serial: spcp8x5: drop broken carrier detect support Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 74/76] USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 75/76] wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb Greg Kroah-Hartman
2026-08-31 13:34 ` [PATCH 7.1 76/76] usb: usbfs: fix use-after-free of usb_device in usbdev_release() Greg Kroah-Hartman
2026-08-31 19:12 ` [PATCH 7.1 00/76] 7.1.13-rc1 review Brett A C Sheffield
2026-09-01 0:45 ` Florian Fainelli
2026-09-01 7:44 ` Barry K. Nathan
2026-09-01 8:42 ` Pavel Machek
2026-09-01 12:06 ` Peter Schneider
2026-09-01 16:44 ` Shuah Khan
2026-09-01 22:59 ` Ron Economos
2026-09-02 1:55 ` Justin Forbes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260831133402.739254064@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=Frank.Li@nxp.com \
--cc=herbert@gondor.apana.org.au \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
--cc=thorsten.blum@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox