Re: [PATCH] crypto: atmel-aes - fix AADLENR for standalone GHASH

[Herbert Xu]

On Sat, Aug 29, 2026 at 06:26:04AM +0200, Karl Mehltretter wrote:
> atmel_aes_gcm_ghash_init() writes dd->total, the request's text length,
> to AES_AADLENR.  But the GHASH it runs hashes the dd->datalen bytes passed
> in: the 16-byte length block, or the padded IV when the IV is not 96 bits.
> The data sheet requires AES_AADLENR to hold the length of that input.
> 
> With empty plaintext and empty AAD, dd->total is 0 and the tag comes out
> wrong.  Later requests only pass because dd->total still holds the
> previous request's length.
> 
> This is testmgr's first gcm(aes) vector, so CONFIG_CRYPTO_SELFTESTS=y
> fails at boot:
> 
>   alg: aead: atmel-gcm-aes encryption test failed (wrong result) on test
>   vector 0, cfg="in-place (one sglist)"
> 
> Without selftests the broken atmel-gcm-aes is preferred at priority 300.
> Seen on a SAM9X75 Curiosity with 6.18 and current mainline.
> 
> Write dd->datalen instead.
> 
> Fixes: d4419548dba9 ("crypto: atmel-aes - add support to GCM mode")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
> ---
>  drivers/crypto/atmel-aes.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt