[PATCH] crypto/ipsec_mb: fix out-of-place operation handling

[Sana Kamboj]

Fix incorrect buffer handling in out-of-place crypto operations.

For out-of-place scatter-gather sessions with NULL security, an
unnecessary memcpy() may dereference an invalid destination buffer and
cause a segmentation fault. Remove the redundant copy operation.

Also add the missing buffer copy for out-of-place non-scatter-gather
sessions, where the output data was not copied to the destination
buffer for the following transform combinations:

- NULL cipher with NULL authentication
- NULL cipher with authentication enabled
- Cipher with authentication enabled

These changes ensure correct out-of-place processing across the affected
transform combinations and prevent crashes in scatter-gather cases.

Cc: skamboj at qti.qualcomm.com

Signed-off-by: Sana Kamboj <skamboj at qti.qualcomm.com>
---
 drivers/crypto/ipsec_mb/pmd_aesni_mb.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
index 4c5b6e70b5..aa3fb4c262 100644
--- a/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
+++ b/drivers/crypto/ipsec_mb/pmd_aesni_mb.c
@@ -1824,12 +1824,6 @@ set_mb_job_params(IMB_JOB *job, struct ipsec_mb_qp *qp,
 		job->msg_len_to_cipher_in_bytes = op->sym->cipher.data.length;
 	}
 
-	if (cipher_mode == IMB_CIPHER_NULL && oop) {
-		memcpy(job->dst + job->cipher_start_src_offset_in_bytes,
-			job->src + job->cipher_start_src_offset_in_bytes,
-			job->msg_len_to_cipher_in_bytes);
-	}
-
 	/* Set user data to be crypto operation data struct */
 	job->user_data = op;
 
@@ -1845,6 +1839,22 @@ set_mb_job_params(IMB_JOB *job, struct ipsec_mb_qp *qp,
 		else
 			return multi_sgl_job(job, op, oop,
 					m_offset, m_src, m_dst, mb_mgr);
+	} else if (oop) {
+		if (cipher_mode == IMB_CIPHER_NULL) {
+			memcpy(rte_pktmbuf_mtod(m_dst, uint8_t *),
+				rte_pktmbuf_mtod(m_src, uint8_t *),
+				job->msg_len_to_cipher_in_bytes +
+				job->cipher_start_src_offset_in_bytes);
+		} else if (cipher_mode == IMB_CIPHER_SNOW3G_UEA2_BITLEN ||
+				cipher_mode == IMB_CIPHER_KASUMI_UEA1_BITLEN) {
+			memcpy(rte_pktmbuf_mtod(m_dst, uint8_t *),
+				rte_pktmbuf_mtod(m_src, uint8_t *),
+				job->cipher_start_src_offset_in_bits >> 3);
+		} else {
+			memcpy(rte_pktmbuf_mtod(m_dst, uint8_t *),
+				rte_pktmbuf_mtod(m_src, uint8_t *),
+				job->cipher_start_src_offset_in_bytes);
+		}
 	}
 
 	return 0;
-- 
2.43.5