crypto: s390/aes - Fix buffer overread in CTR mode

[platform/kernel/linux-starfive.git] / arch / s390 / crypto / paes_s390.c

diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c
index 8b541e4..55ee556 100644 (file)
--- a/arch/s390/crypto/paes_s390.c
+++ b/arch/s390/crypto/paes_s390.c
@@ -693,9 +693,11 @@ static int ctr_paes_crypt(struct skcipher_request *req)
         * final block may be < AES_BLOCK_SIZE, copy only nbytes
         */
        if (nbytes) {
+               memset(buf, 0, AES_BLOCK_SIZE);
+               memcpy(buf, walk.src.virt.addr, nbytes);
                while (1) {
                        if (cpacf_kmctr(ctx->fc, &param, buf,
-                                       walk.src.virt.addr, AES_BLOCK_SIZE,
+                                       buf, AES_BLOCK_SIZE,
                                        walk.iv) == AES_BLOCK_SIZE)
                                break;
                        if (__paes_convert_key(ctx))