Aleksandr Mishin 49833a8da6 crypto: bcm - Fix pointer arithmetic ...

[ Upstream commit 2b3460cbf454c6b03d7429e9ffc4fe09322eb1a9 ]

In spu2_dump_omd() value of ptr is increased by ciph_key_len
instead of hash_iv_len which could lead to going beyond the
buffer boundaries.
Fix this bug by changing ciph_key_len to hash_iv_len.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 9d12ba86f8 ("crypto: brcm - Add Broadcom SPU driver")
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-06-12 11:03:04 +02:00

..

accessibility

speakup: Fix sizeof() vs ARRAY_SIZE() bug

2024-06-12 11:02:55 +02:00

acpi

ACPI: CPPC: Fix access width used for PCC registers

2024-05-02 16:29:29 +02:00

amba

…

android

binder: fix max_thread type inconsistency

2024-05-25 16:21:34 +02:00

ata

ata: sata_gemini: Check clk_enable() result

2024-05-17 11:56:05 +02:00

atm

…

auxdisplay

…

base

driver core: Introduce device_link_wait_removal()

2024-04-10 16:28:32 +02:00

bcma

…

block

aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts

2024-03-26 18:20:29 -04:00

bluetooth

Bluetooth: qca: fix firmware check error path

2024-05-17 11:56:23 +02:00

bus

bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state

2024-04-13 13:05:16 +02:00

cdrom

…

char

timers: Get rid of del_singleshot_timer_sync()

2024-05-17 11:56:12 +02:00

clk

clk: Don't hold prepare_lock when calling kref_put()

2024-05-17 11:56:09 +02:00

clocksource

clocksource/drivers/arm_global_timer: Fix maximum prescaler value

2024-04-03 15:19:44 +02:00

comedi

comedi: vmk80xx: fix incomplete endpoint checking

2024-04-27 17:07:14 +02:00

connector

…

counter

…

cpufreq

cpufreq: Don't unregister cpufreq cooling on CPU hotplug

2024-04-13 13:05:00 +02:00

cpuidle

cpuidle: Avoid potential overflow in integer multiplication

2024-04-13 13:04:54 +02:00

crypto

crypto: bcm - Fix pointer arithmetic

2024-06-12 11:03:04 +02:00

cxl

cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window

2024-03-01 13:26:31 +01:00

dax

…

dca

…

devfreq

…

dio

…

dma

dmaengine: idxd: add a write() method for applications to submit work

2024-05-17 11:56:23 +02:00

dma-buf

dma-buf: Fix NULL pointer dereference in sanitycheck()

2024-04-10 16:28:21 +02:00

edac

…

eisa

…

extcon

…

firewire

firewire: nosy: ensure user_length is taken into account when fetching packet contents

2024-05-17 11:56:16 +02:00

firmware

efi: libstub: only free priv.runtime_map when allocated

2024-06-12 11:03:01 +02:00

fpga

fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card

2024-06-12 11:03:01 +02:00

fsi

…

gnss

…

gpio

gpiolib: cdev: fix uninitialised kfifo

2024-05-17 11:56:15 +02:00

gpu

drm/amdkfd: Flush the process wq before creating a kfd_process

2024-06-12 11:03:02 +02:00

greybus

…

hid

HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up

2024-05-02 16:29:28 +02:00

hsi

…

hte

…

hv

Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted

2024-05-17 11:56:08 +02:00

hwmon

hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us

2024-05-17 11:56:21 +02:00

hwspinlock

…

hwtracing

hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init()

2024-03-26 18:20:58 -04:00

i2c

i2c: smbus: fix NULL function pointer dereference

2024-05-02 16:29:32 +02:00

i3c

…

idle

…

iio

iio: accel: mxc4005: Interrupt handling fixes

2024-05-17 11:56:19 +02:00

infiniband

qibfs: fix dentry leak

2024-05-17 11:56:10 +02:00

input

Input: imagis - use FIELD_GET where applicable

2024-04-13 13:05:13 +02:00

interconnect

Revert "interconnect: Teach lockdep about icc_bw_lock order"

2024-03-06 14:45:19 +00:00

iommu

iommu: mtk: fix module autoloading

2024-05-17 11:56:08 +02:00

ipack

…

irqchip

irqchip/gic-v3-its: Prevent double free on error

2024-05-02 16:29:29 +02:00

isdn

…

leds

leds: sgm3140: Add missing timer cleanup and flash gpio control

2024-03-26 18:20:52 -04:00

macintosh

…

mailbox

…

mcb

…

md

md: fix kmemleak of rdev->serial

2024-05-17 11:56:24 +02:00

media

media: cec: core: remove length check of Timer Status

2024-04-17 11:18:23 +02:00

memory

…

memstick

…

message

…

mfd

mfd: stpmic1: Fix swapped mask/unmask in irq chip

2024-05-25 16:21:30 +02:00

misc

mei: me: add lunar lake point M DID

2024-05-17 11:56:20 +02:00

mmc

mmc: core: Add HS400 tuning in HS400es initialization

2024-05-25 16:21:30 +02:00

most

…

mtd

mtd: diskonchip: work around ubsan link failure

2024-05-02 16:29:30 +02:00

mux

…

net

net: usb: qmi_wwan: add Telit FN920C04 compositions

2024-06-12 11:02:58 +02:00

nfc

NFC: trf7970a: disable all regulators on removal

2024-05-02 16:29:24 +02:00

ntb

NTB: fix possible name leak in ntb_register_device()

2024-03-26 18:20:49 -04:00

nubus

…

nvdimm

…

nvme

nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()

2024-06-12 11:03:03 +02:00

nvmem

nvmem: meson-efuse: fix function pointer type mismatch

2024-04-03 15:19:32 +02:00

of

of: dynamic: Synchronize of_changeset_destroy() with the devlink removals

2024-04-10 16:28:32 +02:00

opp

OPP: debugfs: Fix warning around icc_get_name()

2024-03-26 18:20:42 -04:00

parisc

…

parport

…

pci

PCI/ASPM: Fix deadlock when enabling ASPM

2024-04-27 17:07:18 +02:00

pcmcia

…

peci

…

perf

drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported

2024-04-10 16:28:30 +02:00

phy

phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered

2024-05-02 16:29:31 +02:00

pinctrl

pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()

2024-05-25 16:21:30 +02:00

platform

platform/x86: intel-vbtn: Update tablet mode switch at end of probe

2024-04-13 13:05:26 +02:00

pnp

…

power

power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator

2024-05-17 11:55:55 +02:00

powercap

powercap: dtpm_cpu: Fix error check against freq_qos_add_request()

2024-03-26 18:20:36 -04:00

pps

…

ps3

…

ptp

…

pwm

pwm: img: fix pwm clock lookup

2024-04-03 15:19:45 +02:00

rapidio

…

ras

…

regulator

regulator: vqmmc-ipq4019: fix module autoloading

2024-06-12 11:03:00 +02:00

remoteproc

remoteproc: mediatek: Make sure IPI buffer fits in L2TCM

2024-05-25 16:21:35 +02:00

reset

…

rpmsg

…

rtc

rtc: mt6397: select IRQ_DOMAIN instead of depending on it

2024-03-26 18:20:58 -04:00

s390

s390/qeth: Fix kernel panic after setting hsuid

2024-05-17 11:56:01 +02:00

sbus

…

scsi

scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload

2024-05-17 11:56:04 +02:00

sh

…

siox

…

slimbus

slimbus: qcom-ngd-ctrl: Add timeout for wait operation

2024-05-17 11:56:20 +02:00

soc

soc: fsl: qbman: Use raw spinlock for cgr_lock

2024-04-03 15:19:36 +02:00

soundwire

ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops

2024-04-13 13:05:07 +02:00

spi

spi: microchip-core-qspi: fix setting spi bus clock rate

2024-05-17 11:56:22 +02:00

spmi

…

ssb

…

staging

timers: Get rid of del_singleshot_timer_sync()

2024-05-17 11:56:12 +02:00

target

scsi: target: Fix SELinux error when systemd-modules loads the target module

2024-05-17 11:56:07 +02:00

tc

…

tee

tee: optee: Fix kernel panic caused by incorrect error handling

2024-04-03 15:19:42 +02:00

thermal

thermal/of: Assume polling-delay(-passive) 0 when absent

2024-04-13 13:05:19 +02:00

thunderbolt

thunderbolt: Fix wake configurations after device unplug

2024-04-27 17:07:14 +02:00

tty

serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup

2024-06-12 11:02:55 +02:00

ufs

scsi: ufs: core: WLUN suspend dev/link state error recovery

2024-05-17 11:56:05 +02:00

uio

uio_hv_generic: Don't free decrypted memory

2024-05-17 11:56:08 +02:00

usb

usb: typec: tipd: fix event checking for tps6598x

2024-05-25 16:21:35 +02:00

vdpa

vdpa/mlx5: Allow CVQ size changes

2024-03-26 18:21:00 -04:00

vfio

VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist

2024-05-17 11:56:23 +02:00

vhost

vhost: Add smp_rmb() in vhost_enable_notify()

2024-04-17 11:18:27 +02:00

video

fbdev: fix incorrect address computation in deferred IO

2024-05-02 16:29:30 +02:00

virt

…

virtio

virtio: reenable config if freezing device failed

2024-04-13 13:05:25 +02:00

vlynq

…

w1

…

watchdog

watchdog: stm32_iwdg: initialize default timeout

2024-03-26 18:20:56 -04:00

xen

xen/events: close evtchn after mapping cleanup

2024-03-06 14:45:20 +00:00

zorro

…

Kconfig

…

Makefile

…