Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Herbert writes:
"Crypto Fixes for 4.19
This push fixes the following issues:
- Out-of-bound stack access in qat.
- Illegal schedule in mxs-dcp.
- Memory corruption in chelsio.
- Incorrect pointer computation in caam."
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: qat - Fix KASAN stack-out-of-bounds bug in adf_probe()
crypto: mxs-dcp - Fix wait logic on chan threads
crypto: chelsio - Fix memory corruption in DMA Mapped buffers.
crypto: caam/jr - fix ablkcipher_edesc pointer arithmetic
+76
-55
+4
-4
drivers/crypto/caam/caamalg.c
+4
-4
drivers/crypto/caam/caamalg.c
···
1553
1553
edesc->src_nents = src_nents;
1554
1554
edesc->dst_nents = dst_nents;
1555
1555
edesc->sec4_sg_bytes = sec4_sg_bytes;
1556
-
edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) +
1557
-
desc_bytes;
1556
+
edesc->sec4_sg = (struct sec4_sg_entry *)((u8 *)edesc->hw_desc +
1557
+
desc_bytes);
1558
1558
edesc->iv_dir = DMA_TO_DEVICE;
1559
1559
1560
1560
/* Make sure IV is located in a DMAable area */
···
1757
1757
edesc->src_nents = src_nents;
1758
1758
edesc->dst_nents = dst_nents;
1759
1759
edesc->sec4_sg_bytes = sec4_sg_bytes;
1760
-
edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) +
1761
-
desc_bytes;
1760
+
edesc->sec4_sg = (struct sec4_sg_entry *)((u8 *)edesc->hw_desc +
1761
+
desc_bytes);
1762
1762
edesc->iv_dir = DMA_FROM_DEVICE;
1763
1763
1764
1764
/* Make sure IV is located in a DMAable area */
+22
-10
drivers/crypto/chelsio/chcr_algo.c
+22
-10
drivers/crypto/chelsio/chcr_algo.c
···
367
367
walk->to = (struct phys_sge_pairs *)(dsgl + 1);
368
368
}
369
369
370
-
static inline void dsgl_walk_end(struct dsgl_walk *walk, unsigned short qid)
370
+
static inline void dsgl_walk_end(struct dsgl_walk *walk, unsigned short qid,
371
+
int pci_chan_id)
371
372
{
372
373
struct cpl_rx_phys_dsgl *phys_cpl;
373
374
···
386
385
phys_cpl->rss_hdr_int.opcode = CPL_RX_PHYS_ADDR;
387
386
phys_cpl->rss_hdr_int.qid = htons(qid);
388
387
phys_cpl->rss_hdr_int.hash_val = 0;
388
+
phys_cpl->rss_hdr_int.channel = pci_chan_id;
389
389
}
390
390
391
391
static inline void dsgl_walk_add_page(struct dsgl_walk *walk,
···
720
718
FILL_WR_RX_Q_ID(ctx->dev->rx_channel_id, qid,
721
719
!!lcb, ctx->tx_qidx);
722
720
723
-
chcr_req->ulptx.cmd_dest = FILL_ULPTX_CMD_DEST(ctx->dev->tx_channel_id,
721
+
chcr_req->ulptx.cmd_dest = FILL_ULPTX_CMD_DEST(ctx->tx_chan_id,
724
722
qid);
725
723
chcr_req->ulptx.len = htonl((DIV_ROUND_UP(len16, 16) -
726
724
((sizeof(chcr_req->wreq)) >> 4)));
···
1341
1339
adap->vres.ncrypto_fc);
1342
1340
rxq_perchan = u_ctx->lldi.nrxq / u_ctx->lldi.nchan;
1343
1341
txq_perchan = ntxq / u_ctx->lldi.nchan;
1344
-
rxq_idx = ctx->dev->tx_channel_id * rxq_perchan;
1345
-
rxq_idx += id % rxq_perchan;
1346
-
txq_idx = ctx->dev->tx_channel_id * txq_perchan;
1347
-
txq_idx += id % txq_perchan;
1348
1342
spin_lock(&ctx->dev->lock_chcr_dev);
1349
-
ctx->rx_qidx = rxq_idx;
1350
-
ctx->tx_qidx = txq_idx;
1343
+
ctx->tx_chan_id = ctx->dev->tx_channel_id;
1351
1344
ctx->dev->tx_channel_id = !ctx->dev->tx_channel_id;
1352
1345
ctx->dev->rx_channel_id = 0;
1353
1346
spin_unlock(&ctx->dev->lock_chcr_dev);
1347
+
rxq_idx = ctx->tx_chan_id * rxq_perchan;
1348
+
rxq_idx += id % rxq_perchan;
1349
+
txq_idx = ctx->tx_chan_id * txq_perchan;
1350
+
txq_idx += id % txq_perchan;
1351
+
ctx->rx_qidx = rxq_idx;
1352
+
ctx->tx_qidx = txq_idx;
1353
+
/* Channel Id used by SGE to forward packet to Host.
1354
+
* Same value should be used in cpl_fw6_pld RSS_CH field
1355
+
* by FW. Driver programs PCI channel ID to be used in fw
1356
+
* at the time of queue allocation with value "pi->tx_chan"
1357
+
*/
1358
+
ctx->pci_chan_id = txq_idx / txq_perchan;
1354
1359
}
1355
1360
out:
1356
1361
return err;
···
2512
2503
struct crypto_aead *tfm = crypto_aead_reqtfm(req);
2513
2504
struct dsgl_walk dsgl_walk;
2514
2505
unsigned int authsize = crypto_aead_authsize(tfm);
2506
+
struct chcr_context *ctx = a_ctx(tfm);
2515
2507
u32 temp;
2516
2508
2517
2509
dsgl_walk_init(&dsgl_walk, phys_cpl);
···
2522
2512
dsgl_walk_add_page(&dsgl_walk, IV, &reqctx->iv_dma);
2523
2513
temp = req->cryptlen + (reqctx->op ? -authsize : authsize);
2524
2514
dsgl_walk_add_sg(&dsgl_walk, req->dst, temp, req->assoclen);
2525
-
dsgl_walk_end(&dsgl_walk, qid);
2515
+
dsgl_walk_end(&dsgl_walk, qid, ctx->pci_chan_id);
2526
2516
}
2527
2517
2528
2518
void chcr_add_cipher_src_ent(struct ablkcipher_request *req,
···
2554
2544
unsigned short qid)
2555
2545
{
2556
2546
struct chcr_blkcipher_req_ctx *reqctx = ablkcipher_request_ctx(req);
2547
+
struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(wrparam->req);
2548
+
struct chcr_context *ctx = c_ctx(tfm);
2557
2549
struct dsgl_walk dsgl_walk;
2558
2550
2559
2551
dsgl_walk_init(&dsgl_walk, phys_cpl);
···
2564
2552
reqctx->dstsg = dsgl_walk.last_sg;
2565
2553
reqctx->dst_ofst = dsgl_walk.last_sg_len;
2566
2554
2567
-
dsgl_walk_end(&dsgl_walk, qid);
2555
+
dsgl_walk_end(&dsgl_walk, qid, ctx->pci_chan_id);
2568
2556
}
2569
2557
2570
2558
void chcr_add_hash_src_ent(struct ahash_request *req,
+2
drivers/crypto/chelsio/chcr_crypto.h
+2
drivers/crypto/chelsio/chcr_crypto.h
+30
-23
drivers/crypto/mxs-dcp.c
+30
-23
drivers/crypto/mxs-dcp.c
···
63
63
struct dcp_coherent_block *coh;
64
64
65
65
struct completion completion[DCP_MAX_CHANS];
66
-
struct mutex mutex[DCP_MAX_CHANS];
66
+
spinlock_t lock[DCP_MAX_CHANS];
67
67
struct task_struct *thread[DCP_MAX_CHANS];
68
68
struct crypto_queue queue[DCP_MAX_CHANS];
69
69
};
···
349
349
350
350
int ret;
351
351
352
-
do {
353
-
__set_current_state(TASK_INTERRUPTIBLE);
352
+
while (!kthread_should_stop()) {
353
+
set_current_state(TASK_INTERRUPTIBLE);
354
354
355
-
mutex_lock(&sdcp->mutex[chan]);
355
+
spin_lock(&sdcp->lock[chan]);
356
356
backlog = crypto_get_backlog(&sdcp->queue[chan]);
357
357
arq = crypto_dequeue_request(&sdcp->queue[chan]);
358
-
mutex_unlock(&sdcp->mutex[chan]);
358
+
spin_unlock(&sdcp->lock[chan]);
359
+
360
+
if (!backlog && !arq) {
361
+
schedule();
362
+
continue;
363
+
}
364
+
365
+
set_current_state(TASK_RUNNING);
359
366
360
367
if (backlog)
361
368
backlog->complete(backlog, -EINPROGRESS);
···
370
363
if (arq) {
371
364
ret = mxs_dcp_aes_block_crypt(arq);
372
365
arq->complete(arq, ret);
373
-
continue;
374
366
}
375
-
376
-
schedule();
377
-
} while (!kthread_should_stop());
367
+
}
378
368
379
369
return 0;
380
370
}
···
413
409
rctx->ecb = ecb;
414
410
actx->chan = DCP_CHAN_CRYPTO;
415
411
416
-
mutex_lock(&sdcp->mutex[actx->chan]);
412
+
spin_lock(&sdcp->lock[actx->chan]);
417
413
ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);
418
-
mutex_unlock(&sdcp->mutex[actx->chan]);
414
+
spin_unlock(&sdcp->lock[actx->chan]);
419
415
420
416
wake_up_process(sdcp->thread[actx->chan]);
421
417
···
644
640
struct ahash_request *req;
645
641
int ret, fini;
646
642
647
-
do {
648
-
__set_current_state(TASK_INTERRUPTIBLE);
643
+
while (!kthread_should_stop()) {
644
+
set_current_state(TASK_INTERRUPTIBLE);
649
645
650
-
mutex_lock(&sdcp->mutex[chan]);
646
+
spin_lock(&sdcp->lock[chan]);
651
647
backlog = crypto_get_backlog(&sdcp->queue[chan]);
652
648
arq = crypto_dequeue_request(&sdcp->queue[chan]);
653
-
mutex_unlock(&sdcp->mutex[chan]);
649
+
spin_unlock(&sdcp->lock[chan]);
650
+
651
+
if (!backlog && !arq) {
652
+
schedule();
653
+
continue;
654
+
}
655
+
656
+
set_current_state(TASK_RUNNING);
654
657
655
658
if (backlog)
656
659
backlog->complete(backlog, -EINPROGRESS);
···
669
658
ret = dcp_sha_req_to_buf(arq);
670
659
fini = rctx->fini;
671
660
arq->complete(arq, ret);
672
-
if (!fini)
673
-
continue;
674
661
}
675
-
676
-
schedule();
677
-
} while (!kthread_should_stop());
662
+
}
678
663
679
664
return 0;
680
665
}
···
728
721
rctx->init = 1;
729
722
}
730
723
731
-
mutex_lock(&sdcp->mutex[actx->chan]);
724
+
spin_lock(&sdcp->lock[actx->chan]);
732
725
ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);
733
-
mutex_unlock(&sdcp->mutex[actx->chan]);
726
+
spin_unlock(&sdcp->lock[actx->chan]);
734
727
735
728
wake_up_process(sdcp->thread[actx->chan]);
736
729
mutex_unlock(&actx->mutex);
···
1004
997
platform_set_drvdata(pdev, sdcp);
1005
998
1006
999
for (i = 0; i < DCP_MAX_CHANS; i++) {
1007
-
mutex_init(&sdcp->mutex[i]);
1000
+
spin_lock_init(&sdcp->lock[i]);
1008
1001
init_completion(&sdcp->completion[i]);
1009
1002
crypto_init_queue(&sdcp->queue[i], 50);
1010
1003
}
+3
-3
drivers/crypto/qat/qat_c3xxx/adf_drv.c
+3
-3
drivers/crypto/qat/qat_c3xxx/adf_drv.c
···
123
123
struct adf_hw_device_data *hw_data;
124
124
char name[ADF_DEVICE_NAME_LENGTH];
125
125
unsigned int i, bar_nr;
126
-
int ret, bar_mask;
126
+
unsigned long bar_mask;
127
+
int ret;
127
128
128
129
switch (ent->device) {
129
130
case ADF_C3XXX_PCI_DEVICE_ID:
···
236
235
/* Find and map all the device's BARS */
237
236
i = 0;
238
237
bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
239
-
for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
240
-
ADF_PCI_MAX_BARS * 2) {
238
+
for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
241
239
struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
242
240
243
241
bar->base_addr = pci_resource_start(pdev, bar_nr);
+3
-3
drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+3
-3
drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
···
125
125
struct adf_hw_device_data *hw_data;
126
126
char name[ADF_DEVICE_NAME_LENGTH];
127
127
unsigned int i, bar_nr;
128
-
int ret, bar_mask;
128
+
unsigned long bar_mask;
129
+
int ret;
129
130
130
131
switch (ent->device) {
131
132
case ADF_C3XXXIOV_PCI_DEVICE_ID:
···
216
215
/* Find and map all the device's BARS */
217
216
i = 0;
218
217
bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
219
-
for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
220
-
ADF_PCI_MAX_BARS * 2) {
218
+
for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
221
219
struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
222
220
223
221
bar->base_addr = pci_resource_start(pdev, bar_nr);
+3
-3
drivers/crypto/qat/qat_c62x/adf_drv.c
+3
-3
drivers/crypto/qat/qat_c62x/adf_drv.c
···
123
123
struct adf_hw_device_data *hw_data;
124
124
char name[ADF_DEVICE_NAME_LENGTH];
125
125
unsigned int i, bar_nr;
126
-
int ret, bar_mask;
126
+
unsigned long bar_mask;
127
+
int ret;
127
128
128
129
switch (ent->device) {
129
130
case ADF_C62X_PCI_DEVICE_ID:
···
236
235
/* Find and map all the device's BARS */
237
236
i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0;
238
237
bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
239
-
for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
240
-
ADF_PCI_MAX_BARS * 2) {
238
+
for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
241
239
struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
242
240
243
241
bar->base_addr = pci_resource_start(pdev, bar_nr);
+3
-3
drivers/crypto/qat/qat_c62xvf/adf_drv.c
+3
-3
drivers/crypto/qat/qat_c62xvf/adf_drv.c
···
125
125
struct adf_hw_device_data *hw_data;
126
126
char name[ADF_DEVICE_NAME_LENGTH];
127
127
unsigned int i, bar_nr;
128
-
int ret, bar_mask;
128
+
unsigned long bar_mask;
129
+
int ret;
129
130
130
131
switch (ent->device) {
131
132
case ADF_C62XIOV_PCI_DEVICE_ID:
···
216
215
/* Find and map all the device's BARS */
217
216
i = 0;
218
217
bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
219
-
for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
220
-
ADF_PCI_MAX_BARS * 2) {
218
+
for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
221
219
struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
222
220
223
221
bar->base_addr = pci_resource_start(pdev, bar_nr);
+3
-3
drivers/crypto/qat/qat_dh895xcc/adf_drv.c
+3
-3
drivers/crypto/qat/qat_dh895xcc/adf_drv.c
···
123
123
struct adf_hw_device_data *hw_data;
124
124
char name[ADF_DEVICE_NAME_LENGTH];
125
125
unsigned int i, bar_nr;
126
-
int ret, bar_mask;
126
+
unsigned long bar_mask;
127
+
int ret;
127
128
128
129
switch (ent->device) {
129
130
case ADF_DH895XCC_PCI_DEVICE_ID:
···
238
237
/* Find and map all the device's BARS */
239
238
i = 0;
240
239
bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
241
-
for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
242
-
ADF_PCI_MAX_BARS * 2) {
240
+
for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
243
241
struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
244
242
245
243
bar->base_addr = pci_resource_start(pdev, bar_nr);
+3
-3
drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+3
-3
drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
···
125
125
struct adf_hw_device_data *hw_data;
126
126
char name[ADF_DEVICE_NAME_LENGTH];
127
127
unsigned int i, bar_nr;
128
-
int ret, bar_mask;
128
+
unsigned long bar_mask;
129
+
int ret;
129
130
130
131
switch (ent->device) {
131
132
case ADF_DH895XCCIOV_PCI_DEVICE_ID:
···
216
215
/* Find and map all the device's BARS */
217
216
i = 0;
218
217
bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
219
-
for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
220
-
ADF_PCI_MAX_BARS * 2) {
218
+
for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
221
219
struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
222
220
223
221
bar->base_addr = pci_resource_start(pdev, bar_nr);