tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

crypto: safexcel - Add error handling for dma_map_sg() calls

Macro dma_map_sg() may return 0 on error. This patch enables
checks in case of the macro failure and ensures unmapping of
previously mapped buffers with dma_unmap_sg().

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 49186a7d9e46 ("crypto: inside_secure - Avoid dma map if size is zero")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Reviewed-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

authored by

Nikita Zhandarovich and committed by
Herbert Xu 87e02063 429fec81

+11 -8
+11 -8
drivers/crypto/inside-secure/safexcel_cipher.c
··· 742 742 max(totlen_src, totlen_dst)); 743 743 return -EINVAL; 744 744 } 745 - if (sreq->nr_src > 0) 746 - dma_map_sg(priv->dev, src, sreq->nr_src, 747 - DMA_BIDIRECTIONAL); 745 + if (sreq->nr_src > 0 && 746 + !dma_map_sg(priv->dev, src, sreq->nr_src, DMA_BIDIRECTIONAL)) 747 + return -EIO; 748 748 } else { 749 749 if (unlikely(totlen_src && (sreq->nr_src <= 0))) { 750 750 dev_err(priv->dev, "Source buffer not large enough (need %d bytes)!", ··· 752 752 return -EINVAL; 753 753 } 754 754 755 - if (sreq->nr_src > 0) 756 - dma_map_sg(priv->dev, src, sreq->nr_src, DMA_TO_DEVICE); 755 + if (sreq->nr_src > 0 && 756 + !dma_map_sg(priv->dev, src, sreq->nr_src, DMA_TO_DEVICE)) 757 + return -EIO; 757 758 758 759 if (unlikely(totlen_dst && (sreq->nr_dst <= 0))) { 759 760 dev_err(priv->dev, "Dest buffer not large enough (need %d bytes)!", ··· 763 762 goto unmap; 764 763 } 765 764 766 - if (sreq->nr_dst > 0) 767 - dma_map_sg(priv->dev, dst, sreq->nr_dst, 768 - DMA_FROM_DEVICE); 765 + if (sreq->nr_dst > 0 && 766 + !dma_map_sg(priv->dev, dst, sreq->nr_dst, DMA_FROM_DEVICE)) { 767 + ret = -EIO; 768 + goto unmap; 769 + } 769 770 } 770 771 771 772 memcpy(ctx->base.ctxr->data, ctx->key, ctx->key_len);