On 7/30/2019 2:03 PM, Iuliana Prodan wrote: > Based on seqiv, IPsec ESP and rfc4543/rfc4106 the assoclen can be 16 or > 20 bytes. > > From esp4/esp6, assoclen is sizeof IP Header. This includes spi, seq_no > and extended seq_no, that is 8 or 12 bytes. > In seqiv, to asscolen is added the IV size (8 bytes). > Therefore, the assoclen, for rfc4543, should be restricted to 16 or 20 > bytes, as for rfc4106. > > Signed-off-by: Iuliana Prodan <iuliana.prodan@xxxxxxx> Reviewed-by: Horia Geantă <horia.geanta@xxxxxxx> [...] > diff --git a/crypto/gcm.c b/crypto/gcm.c > index 2f3b50f..7eb5ced 100644 > --- a/crypto/gcm.c > +++ b/crypto/gcm.c > @@ -1034,11 +1034,23 @@ static int crypto_rfc4543_copy_src_to_dst(struct aead_request *req, bool enc) > > static int crypto_rfc4543_encrypt(struct aead_request *req) > { > + int err; > + > + err = crypto_ipsec_check_assoclen(req->assoclen); > + if (err) > + return err; > + > return crypto_rfc4543_crypt(req, true); > } Could as well be: return crypto_ipsec_check_assoclen(req->assoclen) ?: crypto_rfc4543_crypt(req, true); The same for decryption. Horia