issue: blob decapsulation operation store the decrypted data in memory even if ICV check failed.

fix: clear the blob data output memory.

Fixes: c5de15cbc8 (crypto/fsl: Add command for encapsulating/decapsulating blobs) Signed-off-by: Gaurav Jain gaurav.jain@nxp.com Reviewed-by: Kshitiz Varshney kshitiz.varshney@nxp.com Tested-by: Kshitiz Varshney kshitiz.varshney@nxp.com --- drivers/crypto/fsl/fsl_blob.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/drivers/crypto/fsl/fsl_blob.c b/drivers/crypto/fsl/fsl_blob.c index e8202cc569..9b6e4bca06 100644 --- a/drivers/crypto/fsl/fsl_blob.c +++ b/drivers/crypto/fsl/fsl_blob.c @@ -71,6 +71,10 @@ int blob_decap(u8 *key_mod, u8 *src, u8 *dst, u32 len) ret = run_descriptor_jr(desc);

if (ret) { + /* clear the blob data output buffer */ + memset(dst, 0x00, len); + size = ALIGN(len, ARCH_DMA_MINALIGN); + flush_dcache_range((unsigned long)dst, (unsigned long)dst + size); printf("Error in blob decapsulation: %d\n", ret); } else { size = ALIGN(len, ARCH_DMA_MINALIGN);