crypto StarFive Overflow

Vulnerability analysis

The root cause is improper handling of the sg_nents_for_len() return value in starfive_hash_digest(). The function returns a signed integer that can be negative (error code), but was assigned directly to an unsigned long field, causing negative values to wrap to large positive integers. This corrupted length value could then be used to iterate beyond the bounds of the scatter-gather list, resulting in out-of-bounds reads of kernel memory and potential buffer overflows. The fix adds proper error checking by storing the return value in a signed variable, validating it is non-negative, and only then assigning to the unsigned field. The attack surface is local and reachable by unprivileged users through standard crypto hash APIs such as AF_ALG sockets.