linux-kernel - Re: [PATCH 1/4] crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aA9sQ5p9_wQ2Vmhb@gondor.apana.org.au>
Date: Mon, 28 Apr 2025 19:53:39 +0800
From: Herbert Xu <herbert@...dor.apana.org.au>
To: Ovidiu Panait <ovidiu.panait.oss@...il.com>
Cc: clabbe.montjoie@...il.com, davem@...emloft.net,
	linux-crypto@...r.kernel.org, wens@...e.org,
	jernej.skrabec@...il.com, samuel@...lland.org,
	linux-arm-kernel@...ts.infradead.org, linux-sunxi@...ts.linux.dev,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/4] crypto: sun8i-ce-cipher - fix error handling in
 sun8i_ce_cipher_prepare()

On Fri, Apr 25, 2025 at 03:45:14PM +0300, Ovidiu Panait wrote:
> Fix two DMA cleanup issues on the error path in sun8i_ce_cipher_prepare():
> 
> 1] If dma_map_sg() fails for areq->dst, the device driver would try to free
>    DMA memory it has not allocated in the first place. To fix this, on the
>    "theend_sgs" error path, call dma unmap only if the corresponding dma
>    map was successful.
> 
> 2] If the dma_map_single() call for the IV fails, the device driver would
>    try to free an invalid DMA memory address on the "theend_iv" path:
>    ------------[ cut here ]------------
>    DMA-API: sun8i-ce 1904000.crypto: device driver tries to free an invalid DMA memory address
>    WARNING: CPU: 2 PID: 69 at kernel/dma/debug.c:968 check_unmap+0x123c/0x1b90
>    Modules linked in: skcipher_example(O+)
>    CPU: 2 UID: 0 PID: 69 Comm: 1904000.crypto- Tainted: G           O        6.15.0-rc3+ #24 PREEMPT
>    Tainted: [O]=OOT_MODULE
>    Hardware name: OrangePi Zero2 (DT)
>    pc : check_unmap+0x123c/0x1b90
>    lr : check_unmap+0x123c/0x1b90
>    ...
>    Call trace:
>     check_unmap+0x123c/0x1b90 (P)
>     debug_dma_unmap_page+0xac/0xc0
>     dma_unmap_page_attrs+0x1f4/0x5fc
>     sun8i_ce_cipher_do_one+0x1bd4/0x1f40
>     crypto_pump_work+0x334/0x6e0
>     kthread_worker_fn+0x21c/0x438
>     kthread+0x374/0x664
>     ret_from_fork+0x10/0x20
>    ---[ end trace 0000000000000000 ]---
> 
> To fix this, check for !dma_mapping_error() before calling
> dma_unmap_single() on the "theend_iv" path.
> 
> Fixes: 06f751b61329 ("crypto: allwinner - Add sun8i-ce Crypto Engine")
> Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@...il.com>
> ---
>  drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)

All applied.  Thanks.
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt