drivers/crypto/qce/common.c:293 qce_xts_swapiv() error: buffer overflow 'swap' 16 <= 31

BCC: [email protected]
CC: [email protected]
CC: [email protected]
TO: Thorsten Blum <[email protected]>
CC: Herbert Xu <[email protected]>
CC: Bjorn Andersson <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   06cf61899d6498b33e4b7c87d99d5bd471ccc375
commit: 3787fb7697a942baa25361bfc3390575e5659db8 crypto: qce - simplify qce_xts_swapiv()
date:   4 months ago
:::::: branch date: 2 days ago
:::::: commit date: 4 months ago
config: nios2-randconfig-r072-20260810 (https://download.01.org/0day-ci/archive/20260811/[email protected]/config)
compiler: nios2-linux-gcc (GCC) 11.5.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 3787fb7697a9 ("crypto: qce - simplify qce_xts_swapiv()")
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

smatch warnings:
drivers/crypto/qce/common.c:293 qce_xts_swapiv() error: buffer overflow 'swap' 16 <= 31

vim +/swap +293 drivers/crypto/qce/common.c

59e056cda4beb5 Eneas U de Queiroz 2019-12-20  279  
db0018a8b615e2 Thara Gopinath     2021-04-29  280  #ifdef CONFIG_CRYPTO_DEV_QCE_SKCIPHER
59e056cda4beb5 Eneas U de Queiroz 2019-12-20  281  static void qce_xts_swapiv(__be32 *dst, const u8 *src, unsigned int ivsize)
59e056cda4beb5 Eneas U de Queiroz 2019-12-20  282  {
3787fb7697a942 Thorsten Blum      2026-03-30  283  	u8 swap[QCE_AES_IV_LENGTH] = {0};
3787fb7697a942 Thorsten Blum      2026-03-30  284  	unsigned int i, offset;
59e056cda4beb5 Eneas U de Queiroz 2019-12-20  285  
59e056cda4beb5 Eneas U de Queiroz 2019-12-20  286  	if (ivsize > QCE_AES_IV_LENGTH)
59e056cda4beb5 Eneas U de Queiroz 2019-12-20  287  		return;
59e056cda4beb5 Eneas U de Queiroz 2019-12-20  288  
3787fb7697a942 Thorsten Blum      2026-03-30  289  	offset = QCE_AES_IV_LENGTH - ivsize;
59e056cda4beb5 Eneas U de Queiroz 2019-12-20  290  
3787fb7697a942 Thorsten Blum      2026-03-30  291  	/* Reverse and right-align IV bytes. */
3787fb7697a942 Thorsten Blum      2026-03-30  292  	for (i = 0; i < ivsize; i++)
3787fb7697a942 Thorsten Blum      2026-03-30 @293  		swap[offset + i] = src[ivsize - 1 - i];
59e056cda4beb5 Eneas U de Queiroz 2019-12-20  294  
59e056cda4beb5 Eneas U de Queiroz 2019-12-20  295  	qce_cpu_to_be32p_array(dst, swap, QCE_AES_IV_LENGTH);
59e056cda4beb5 Eneas U de Queiroz 2019-12-20  296  }
59e056cda4beb5 Eneas U de Queiroz 2019-12-20  297  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki