[PATCH v2 3/7] crypto: ti - Fix potential memory corruption on highmem pages
From: T Pratham
Date: Thu Aug 27 2026 - 09:53:02 EST
Change sg_set_buf to sg_set_page in DTHEv2 dthe_copy_sg function to
avoid using sg_virt() on scatterlists. For scatterlists containing a
highmem page, sg_virt() yields invalid or null adrdess, causing
potential memory corruption. While we are here, also change function
signature to change buflen from int to unsigned int.
Fixes: 35645ca63caa1 ("crypto: ti - Add support for AES-CTR in DTHEv2 driver")
Signed-off-by: T Pratham <t-pratham@xxxxxx>
---
drivers/crypto/ti/dthev2-common.c | 4 ++--
drivers/crypto/ti/dthev2-common.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/ti/dthev2-common.c b/drivers/crypto/ti/dthev2-common.c
index 4c6b72ba104ec..8628187a32e18 100644
--- a/drivers/crypto/ti/dthev2-common.c
+++ b/drivers/crypto/ti/dthev2-common.c
@@ -50,7 +50,7 @@ struct dthe_data *dthe_get_dev(struct dthe_tfm_ctx *ctx)
struct scatterlist *dthe_copy_sg(struct scatterlist *dst,
struct scatterlist *src,
- int buflen)
+ unsigned int buflen)
{
struct scatterlist *from_sg, *to_sg;
int sglen;
@@ -59,7 +59,7 @@ struct scatterlist *dthe_copy_sg(struct scatterlist *dst,
sglen = from_sg->length;
if (sglen > buflen)
sglen = buflen;
- sg_set_buf(to_sg, sg_virt(from_sg), sglen);
+ sg_set_page(to_sg, sg_page(from_sg), sglen, from_sg->offset);
from_sg = sg_next(from_sg);
to_sg = sg_next(to_sg);
}
diff --git a/drivers/crypto/ti/dthev2-common.h b/drivers/crypto/ti/dthev2-common.h
index d4a3b9c18bbc1..75d9a097650da 100644
--- a/drivers/crypto/ti/dthev2-common.h
+++ b/drivers/crypto/ti/dthev2-common.h
@@ -126,7 +126,7 @@ struct dthe_data *dthe_get_dev(struct dthe_tfm_ctx *ctx);
**/
struct scatterlist *dthe_copy_sg(struct scatterlist *dst,
struct scatterlist *src,
- int buflen);
+ unsigned int buflen);
int dthe_register_aes_algs(void);
void dthe_unregister_aes_algs(void);
--
2.34.1