Hi Greg, You can cherry-pick 307fd543f3d23f8f56850eca1b27b1be2fe71017 on stable 3.13+ as well. The original 'cc stable 3.13+' line was deleted by mistake during commit. Thank you, Cristian S. On 10/13/2014 05:24 AM, Greg Kroah-Hartman wrote: > 3.14-stable review patch. If anyone has any objections, please let me know. > > ------------------ > > From: Cristian Stoica <cristian.stoica@xxxxxxxxxxxxx> > > commit 4451d494b1910bf7b7f8381a637d0fe6d2142467 upstream. > > buf_0 and buf_1 in caam_hash_state are not next to each other. > Accessing buf_1 is incorrect from &buf_0 with an offset of only > size_of(buf_0). The same issue is also with buflen_0 and buflen_1 > > Signed-off-by: Cristian Stoica <cristian.stoica@xxxxxxxxxxxxx> > Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> > Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> > > --- > drivers/crypto/caam/caamhash.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > --- a/drivers/crypto/caam/caamhash.c > +++ b/drivers/crypto/caam/caamhash.c > @@ -1348,9 +1348,9 @@ static int ahash_update_first(struct aha > struct device *jrdev = ctx->jrdev; > gfp_t flags = (req->base.flags & (CRYPTO_TFM_REQ_MAY_BACKLOG | > CRYPTO_TFM_REQ_MAY_SLEEP)) ? GFP_KERNEL : GFP_ATOMIC; > - u8 *next_buf = state->buf_0 + state->current_buf * > - CAAM_MAX_HASH_BLOCK_SIZE; > - int *next_buflen = &state->buflen_0 + state->current_buf; > + u8 *next_buf = state->current_buf ? state->buf_1 : state->buf_0; > + int *next_buflen = state->current_buf ? > + &state->buflen_1 : &state->buflen_0; > int to_hash; > u32 *sh_desc = ctx->sh_desc_update_first, *desc; > dma_addr_t ptr = ctx->sh_desc_update_first_dma; > > -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html