diff options
| -rw-r--r-- | drivers/crypto/msm/qcedev.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/crypto/msm/qcedev.c b/drivers/crypto/msm/qcedev.c index 5ce87a6edcc3..7459401979fe 100644 --- a/drivers/crypto/msm/qcedev.c +++ b/drivers/crypto/msm/qcedev.c @@ -1490,6 +1490,11 @@ static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req, } /* Check for sum of all dst length is equal to data_len */ for (i = 0, total = 0; i < req->entries; i++) { + if (!req->vbuf.dst[i].vaddr && req->vbuf.dst[i].len) { + pr_err("%s: NULL req dst vbuf[%d] with length %d\n", + __func__, i, req->vbuf.dst[i].len); + goto error; + } if (req->vbuf.dst[i].len >= U32_MAX - total) { pr_err("%s: Integer overflow on total req dst vbuf length\n", __func__); @@ -1504,6 +1509,11 @@ static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req, } /* Check for sum of all src length is equal to data_len */ for (i = 0, total = 0; i < req->entries; i++) { + if (!req->vbuf.src[i].vaddr && req->vbuf.src[i].len) { + pr_err("%s: NULL req src vbuf[%d] with length %d\n", + __func__, i, req->vbuf.src[i].len); + goto error; + } if (req->vbuf.src[i].len > U32_MAX - total) { pr_err("%s: Integer overflow on total req src vbuf length\n", __func__); |