atmel_aes_gcm_ghash_init() writes dd->total, the request's text length,
to AES_AADLENR.  But the GHASH it runs hashes the dd->datalen bytes passed
in: the 16-byte length block, or the padded IV when the IV is not 96 bits.
The data sheet requires AES_AADLENR to hold the length of that input.

With empty plaintext and empty AAD, dd->total is 0 and the tag comes out
wrong.  Later requests only pass because dd->total still holds the
previous request's length.

This is testmgr's first gcm(aes) vector, so CONFIG_CRYPTO_SELFTESTS=y
fails at boot:

  alg: aead: atmel-gcm-aes encryption test failed (wrong result) on test
  vector 0, cfg="in-place (one sglist)"

Without selftests the broken atmel-gcm-aes is preferred at priority 300.
Seen on a SAM9X75 Curiosity with 6.18 and current mainline.

Write dd->datalen instead.

Fixes: d4419548dba9 ("crypto: atmel-aes - add support to GCM mode")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 drivers/crypto/atmel-aes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
index 50d97cef75b8..8e4de859cadc 100644
--- a/drivers/crypto/atmel-aes.c
+++ b/drivers/crypto/atmel-aes.c
@@ -1267,7 +1267,7 @@ static int atmel_aes_gcm_ghash_init(struct atmel_aes_dev *dd)
 	struct atmel_aes_gcm_ctx *ctx = atmel_aes_gcm_ctx_cast(dd->ctx);
 
 	/* Set the data length. */
-	atmel_aes_write(dd, AES_AADLENR, dd->total);
+	atmel_aes_write(dd, AES_AADLENR, dd->datalen);
 	atmel_aes_write(dd, AES_CLENR, 0);
 
 	/* If needed, overwrite the GCM Intermediate Hash Word Registers */
-- 
2.39.5 (Apple Git-154)

On Sat, Aug 29, 2026 at 06:26:04AM +0200, Karl Mehltretter wrote:
> atmel_aes_gcm_ghash_init() writes dd->total, the request's text length,
> to AES_AADLENR.  But the GHASH it runs hashes the dd->datalen bytes passed
> in: the 16-byte length block, or the padded IV when the IV is not 96 bits.
> The data sheet requires AES_AADLENR to hold the length of that input.
> 
> With empty plaintext and empty AAD, dd->total is 0 and the tag comes out
> wrong.  Later requests only pass because dd->total still holds the
> previous request's length.
> 
> This is testmgr's first gcm(aes) vector, so CONFIG_CRYPTO_SELFTESTS=y
> fails at boot:
> 
>   alg: aead: atmel-gcm-aes encryption test failed (wrong result) on test
>   vector 0, cfg="in-place (one sglist)"
> 
> Without selftests the broken atmel-gcm-aes is preferred at priority 300.
> Seen on a SAM9X75 Curiosity with 6.18 and current mainline.
> 
> Write dd->datalen instead.
> 
> Fixes: d4419548dba9 ("crypto: atmel-aes - add support to GCM mode")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
>  drivers/crypto/atmel-aes.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt