Re: [PATCH] crypto: qce: fix CCM AAD buffer underallocation

On Fri, Aug 07, 2026 at 12:24:54PM +0530, Md Sadre Alam wrote:
> The AAD buffer allocated in qce_aead_ccm_prepare_buf_assoclen()
> can be smaller than the length later programmed into the DMA
> scatterlist.
> 
> The allocation size is currently calculated as:
> 
>   ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN
> 
> while the DMA length is set to:
> 
>   ALIGN(assoclen + adata_header_len, 16)
> 
> Since ALIGN() does not distribute over addition, the allocation
> can be smaller than the DMA length. For example, when
> assoclen = 32 and adata_header_len = 2:
> 
>   allocation = ALIGN(32, 16) + 6 = 38
>   DMA length = ALIGN(32 + 2, 16) = 48
> 
> As a result, the QCE hardware can read beyond the allocated
> buffer while computing the CBC-MAC over the associated data.
> The extra bytes are folded into the authentication tag,
> resulting in an incorrect tag and causing CCM self-test
> failures such as:
> 
>   alg: aead: ccm-aes-qce encryption test failed (wrong result)
>   on test vector 8
> 
> Fix the allocation by adding the maximum possible AAD header
> length before alignment:
> 
>   ALIGN(assoclen + MAX_CCM_ADATA_HEADER_LEN, 16)
> 
> This guarantees that the allocated buffer is large enough
> for the fully padded AAD data for all supported header sizes.
> 
> Cc: [email protected]
> Fixes: 9363efb4181c ("crypto: qce - Add support for AEAD algorithms")
> Signed-off-by: Md Sadre Alam <[email protected]>
> ---
>  drivers/crypto/qce/aead.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt