crypto: qce: fix CCM AAD buffer underallocation

[PATCH] crypto: qce: fix CCM AAD buffer underallocation

Posted by Md Sadre Alam 1 month, 3 weeks ago

The AAD buffer allocated in qce_aead_ccm_prepare_buf_assoclen()
can be smaller than the length later programmed into the DMA
scatterlist.

The allocation size is currently calculated as:

  ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN

while the DMA length is set to:

  ALIGN(assoclen + adata_header_len, 16)

Since ALIGN() does not distribute over addition, the allocation
can be smaller than the DMA length. For example, when
assoclen = 32 and adata_header_len = 2:

  allocation = ALIGN(32, 16) + 6 = 38
  DMA length = ALIGN(32 + 2, 16) = 48

As a result, the QCE hardware can read beyond the allocated
buffer while computing the CBC-MAC over the associated data.
The extra bytes are folded into the authentication tag,
resulting in an incorrect tag and causing CCM self-test
failures such as:

  alg: aead: ccm-aes-qce encryption test failed (wrong result)
  on test vector 8

Fix the allocation by adding the maximum possible AAD header
length before alignment:

  ALIGN(assoclen + MAX_CCM_ADATA_HEADER_LEN, 16)

This guarantees that the allocated buffer is large enough
for the fully padded AAD data for all supported header sizes.

Cc: stable@vger.kernel.org
Fixes: 9363efb4181c ("crypto: qce - Add support for AEAD algorithms")
Signed-off-by: Md Sadre Alam <md.alam@oss.qualcomm.com>
---
 drivers/crypto/qce/aead.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c
index 92d84941d3db..a9642c67f476 100644
--- a/drivers/crypto/qce/aead.c
+++ b/drivers/crypto/qce/aead.c
@@ -196,7 +196,7 @@ qce_aead_ccm_prepare_buf_assoclen(struct aead_request *req)
 	/* Get the msg */
 	msg_sg = scatterwalk_ffwd(__sg, req->src, req->assoclen);
 
-	rctx->adata = kzalloc((ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN) *
+	rctx->adata = kzalloc(ALIGN(assoclen + MAX_CCM_ADATA_HEADER_LEN, 16) *
 			       sizeof(unsigned char), GFP_ATOMIC);
 	if (!rctx->adata)
 		return -ENOMEM;
-- 
2.34.1

Re: [PATCH] crypto: qce: fix CCM AAD buffer underallocation

Posted by Herbert Xu 1 month, 2 weeks ago

On Fri, Aug 07, 2026 at 12:24:54PM +0530, Md Sadre Alam wrote:
> The AAD buffer allocated in qce_aead_ccm_prepare_buf_assoclen()
> can be smaller than the length later programmed into the DMA
> scatterlist.
> 
> The allocation size is currently calculated as:
> 
>   ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN
> 
> while the DMA length is set to:
> 
>   ALIGN(assoclen + adata_header_len, 16)
> 
> Since ALIGN() does not distribute over addition, the allocation
> can be smaller than the DMA length. For example, when
> assoclen = 32 and adata_header_len = 2:
> 
>   allocation = ALIGN(32, 16) + 6 = 38
>   DMA length = ALIGN(32 + 2, 16) = 48
> 
> As a result, the QCE hardware can read beyond the allocated
> buffer while computing the CBC-MAC over the associated data.
> The extra bytes are folded into the authentication tag,
> resulting in an incorrect tag and causing CCM self-test
> failures such as:
> 
>   alg: aead: ccm-aes-qce encryption test failed (wrong result)
>   on test vector 8
> 
> Fix the allocation by adding the maximum possible AAD header
> length before alignment:
> 
>   ALIGN(assoclen + MAX_CCM_ADATA_HEADER_LEN, 16)
> 
> This guarantees that the allocated buffer is large enough
> for the fully padded AAD data for all supported header sizes.
> 
> Cc: stable@vger.kernel.org
> Fixes: 9363efb4181c ("crypto: qce - Add support for AEAD algorithms")
> Signed-off-by: Md Sadre Alam <md.alam@oss.qualcomm.com>
> ---
>  drivers/crypto/qce/aead.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] crypto: qce: fix CCM AAD buffer underallocation

Posted by Bartosz Golaszewski 1 month, 2 weeks ago

On Fri, 7 Aug 2026 08:54:54 +0200, Md Sadre Alam
<md.alam@oss.qualcomm.com> said:
> The AAD buffer allocated in qce_aead_ccm_prepare_buf_assoclen()
> can be smaller than the length later programmed into the DMA
> scatterlist.
>
> The allocation size is currently calculated as:
>
>   ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN
>
> while the DMA length is set to:
>
>   ALIGN(assoclen + adata_header_len, 16)
>
> Since ALIGN() does not distribute over addition, the allocation
> can be smaller than the DMA length. For example, when
> assoclen = 32 and adata_header_len = 2:
>
>   allocation = ALIGN(32, 16) + 6 = 38
>   DMA length = ALIGN(32 + 2, 16) = 48
>
> As a result, the QCE hardware can read beyond the allocated
> buffer while computing the CBC-MAC over the associated data.
> The extra bytes are folded into the authentication tag,
> resulting in an incorrect tag and causing CCM self-test
> failures such as:
>
>   alg: aead: ccm-aes-qce encryption test failed (wrong result)
>   on test vector 8
>
> Fix the allocation by adding the maximum possible AAD header
> length before alignment:
>
>   ALIGN(assoclen + MAX_CCM_ADATA_HEADER_LEN, 16)
>
> This guarantees that the allocated buffer is large enough
> for the fully padded AAD data for all supported header sizes.
>
> Cc: stable@vger.kernel.org
> Fixes: 9363efb4181c ("crypto: qce - Add support for AEAD algorithms")
> Signed-off-by: Md Sadre Alam <md.alam@oss.qualcomm.com>
> ---

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>