Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare()

Fix two DMA cleanup issues on the error path in sun8i_ce_cipher_prepare():

1] If dma_map_sg() fails for areq->dst, the device driver would try to free
DMA memory it has not allocated in the first place. To fix this, on the
"theend_sgs" error path, call dma unmap only if the corresponding dma
map was successful.

2] If the dma_map_single() call for the IV fails, the device driver would
try to free an invalid DMA memory address on the "theend_iv" path:
------------[ cut here ]------------
DMA-API: sun8i-ce 1904000.crypto: device driver tries to free an invalid DMA memory address
WARNING: CPU: 2 PID: 69 at kernel/dma/debug.c:968 check_unmap+0x123c/0x1b90
Modules linked in: skcipher_example(O+)
CPU: 2 UID: 0 PID: 69 Comm: 1904000.crypto- Tainted: G O 6.15.0-rc3+ #24 PREEMPT
Tainted: [O]=OOT_MODULE
Hardware name: OrangePi Zero2 (DT)
pc : check_unmap+0x123c/0x1b90
lr : check_unmap+0x123c/0x1b90
...
Call trace:
check_unmap+0x123c/0x1b90 (P)
debug_dma_unmap_page+0xac/0xc0
dma_unmap_page_attrs+0x1f4/0x5fc
sun8i_ce_cipher_do_one+0x1bd4/0x1f40
crypto_pump_work+0x334/0x6e0
kthread_worker_fn+0x21c/0x438
kthread+0x374/0x664
ret_from_fork+0x10/0x20
---[ end trace 0000000000000000 ]---

To fix this, check for !dma_mapping_error() before calling
dma_unmap_single() on the "theend_iv" path.

Fixes: 06f751b61329 ("crypto: allwinner - Add sun8i-ce Crypto Engine")
Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

authored by

Ovidiu Panait and committed by
Herbert Xu
f31adc3e b75fa20c

+5 -2
+5 -2
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
··· 275 275 } else { 276 276 if (nr_sgs > 0) 277 277 dma_unmap_sg(ce->dev, areq->src, ns, DMA_TO_DEVICE); 278 - dma_unmap_sg(ce->dev, areq->dst, nd, DMA_FROM_DEVICE); 278 + 279 + if (nr_sgd > 0) 280 + dma_unmap_sg(ce->dev, areq->dst, nd, DMA_FROM_DEVICE); 279 281 } 280 282 281 283 theend_iv: 282 284 if (areq->iv && ivsize > 0) { 283 - if (rctx->addr_iv) 285 + if (!dma_mapping_error(ce->dev, rctx->addr_iv)) 284 286 dma_unmap_single(ce->dev, rctx->addr_iv, rctx->ivlen, DMA_TO_DEVICE); 287 + 285 288 offset = areq->cryptlen - ivsize; 286 289 if (rctx->op_dir & CE_DECRYPTION) { 287 290 memcpy(areq->iv, chan->backup_iv, ivsize);