d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix cryptodev UIO creation.

Browse Source 
Cryptodev uses UIO structure do get data from userspace and pass it to
cryptographic engines. Initially UIO size is equal to size of data passed to
engine, but if UIO is prepared for hash calculation an additional small space
is created to hold result of operation.

While creating space for the result, UIO I/O vector size is correctly
extended, but uio_resid field in UIO structure is not modified.

As bus_dma code uses uio_resid field to determine size of UIO DMA mapping,
resulting mapping hasn't correct size. This leads to a crash if all the
following conditions are met:

     1. Hardware cryptographic accelerator writes result of hash operation
        using DMA.
     2. Size of input data is less or equal than (n * PAGE_SIZE),
     3. Size of input data plus size of hash result is grather than
        (n * PAGE_SIZE, where n is the same as in point 2.

This patch fixes this problem by adding size of the extenstion to uio_resid
field in UIO structure.

Submitted by:	Piotr Ziecik kosmo ! semihalf dot com
Reviewed by:	philip
Obtained from:	Semihalf
This commit is contained in:
Rafal Jaworowski 2009-05-23 13:23:46 +00:00
parent 813bb2c94e
commit ae184a6a7d
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=192636
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/opencrypto/cryptodev.c
View File

@ -409,8 +409,10 @@ cryptodev_op(
cse->uio.uio_rw = UIO_WRITE;
cse->uio.uio_td = td;
cse->uio.uio_iov[0].iov_len = cop->len;
if (cse->thash)
if (cse->thash) {
cse->uio.uio_iov[0].iov_len += cse->thash->hashsize;
cse->uio.uio_resid += cse->thash->hashsize;
}
cse->uio.uio_iov[0].iov_base = malloc(cse->uio.uio_iov[0].iov_len,
M_XDATA, M_WAITOK);