linux-kernel - Re: [BUG] crypto: ccree: driver does not handle case where cryptlen = authsize =0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 7 Mar 2022 09:59:29 +0200
From:   Gilad Ben-Yossef <gilad@...yossef.com>
To:     Herbert Xu <herbert@...dor.apana.org.au>
Cc:     Corentin Labbe <clabbe.montjoie@...il.com>,
        Linux Crypto Mailing List <linux-crypto@...r.kernel.org>,
        Linux kernel mailing list <linux-kernel@...r.kernel.org>
Subject: Re: [BUG] crypto: ccree: driver does not handle case where cryptlen =
 authsize =0

On Sun, Mar 6, 2022 at 11:49 PM Herbert Xu <herbert@...dor.apana.org.au> wrote:
>
> On Fri, Mar 04, 2022 at 02:30:06PM +0100, Corentin Labbe wrote:
> >
> > Hello
> >
> > I got:
> > [   17.563793] ------------[ cut here ]------------
> > [   17.568492] DMA-API: ccree e6601000.crypto: device driver frees DMA memory with different direction [device address=0x0000000078fe5800] [size=8 bytes] [mapped with DMA_TO_DEVICE] [unmapped with DMA_BIDIRECTIONAL]
>
> The direction argument during unmap must match whatever direction
> you used during the original map call.


Yes, of course. I changed one but forgot the other.

Corentin, could you be kind and check that this solves the original
problem and does not produce new warnings?

diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c
b/drivers/crypto/ccree/cc_buffer_mgr.c
index 11e0278c8631..31cfe014922e 100644
--- a/drivers/crypto/ccree/cc_buffer_mgr.c
+++ b/drivers/crypto/ccree/cc_buffer_mgr.c
@@ -356,12 +356,14 @@ void cc_unmap_cipher_request(struct device *dev,
void *ctx,
                              req_ctx->mlli_params.mlli_dma_addr);
        }

-       dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_BIDIRECTIONAL);
-       dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src));
-
        if (src != dst) {
-               dma_unmap_sg(dev, dst, req_ctx->out_nents, DMA_BIDIRECTIONAL);
+               dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_TO_DEVICE);
+               dma_unmap_sg(dev, dst, req_ctx->out_nents, DMA_FROM_DEVICE);
                dev_dbg(dev, "Unmapped req->dst=%pK\n", sg_virt(dst));
+               dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src));
+       } else {
+               dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_BIDIRECTIONAL);
+               dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src));
        }
 }

@@ -377,6 +379,7 @@ int cc_map_cipher_request(struct cc_drvdata
*drvdata, void *ctx,
        u32 dummy = 0;
        int rc = 0;
        u32 mapped_nents = 0;
+       int src_direction = (src != dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL);

        req_ctx->dma_buf_type = CC_DMA_BUF_DLLI;
        mlli_params->curr_pool = NULL;
@@ -399,7 +402,7 @@ int cc_map_cipher_request(struct cc_drvdata
*drvdata, void *ctx,
        }

        /* Map the src SGL */
-       rc = cc_map_sg(dev, src, nbytes, DMA_BIDIRECTIONAL, &req_ctx->in_nents,
+       rc = cc_map_sg(dev, src, nbytes, src_direction, &req_ctx->in_nents,
                       LLI_MAX_NUM_OF_DATA_ENTRIES, &dummy, &mapped_nents);
        if (rc)
                goto cipher_exit;
@@ -416,7 +419,7 @@ int cc_map_cipher_request(struct cc_drvdata
*drvdata, void *ctx,
                }
        } else {
                /* Map the dst sg */
-               rc = cc_map_sg(dev, dst, nbytes, DMA_BIDIRECTIONAL,
+               rc = cc_map_sg(dev, dst, nbytes, DMA_FROM_DEVICE,
                               &req_ctx->out_nents, LLI_MAX_NUM_OF_DATA_ENTRIES,
                               &dummy, &mapped_nents);
                if (rc)


>
> Cheers,
> --
> Email: Herbert Xu <herbert@...dor.apana.org.au>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt



-- 
Gilad Ben-Yossef
Chief Coffee Drinker

values of β will give rise to dom!