On Fri, Apr 25, 2025 at 03:45:14PM +0300, Ovidiu Panait wrote:
> Fix two DMA cleanup issues on the error path in sun8i_ce_cipher_prepare():
>
> 1] If dma_map_sg() fails for areq->dst, the device driver would try to free
> DMA memory it has not allocated in the first place. To fix this, on the
> "theend_sgs" error path, call dma unmap only if the corresponding dma
> map was successful.
>
> 2] If the dma_map_single() call for the IV fails, the device driver would
> try to free an invalid DMA memory address on the "theend_iv" path:
> ------------[ cut here ]------------
> DMA-API: sun8i-ce 1904000.crypto: device driver tries to free an invalid DMA memory address
> WARNING: CPU: 2 PID: 69 at kernel/dma/debug.c:968 check_unmap+0x123c/0x1b90
> Modules linked in: skcipher_example(O+)
> CPU: 2 UID: 0 PID: 69 Comm: 1904000.crypto- Tainted: G O 6.15.0-rc3+ #24 PREEMPT
> Tainted: [O]=OOT_MODULE
> Hardware name: OrangePi Zero2 (DT)
> pc : check_unmap+0x123c/0x1b90
> lr : check_unmap+0x123c/0x1b90
> ...
> Call trace:
> check_unmap+0x123c/0x1b90 (P)
> debug_dma_unmap_page+0xac/0xc0
> dma_unmap_page_attrs+0x1f4/0x5fc
> sun8i_ce_cipher_do_one+0x1bd4/0x1f40
> crypto_pump_work+0x334/0x6e0
> kthread_worker_fn+0x21c/0x438
> kthread+0x374/0x664
> ret_from_fork+0x10/0x20
> ---[ end trace 0000000000000000 ]---
>
> To fix this, check for !dma_mapping_error() before calling
> dma_unmap_single() on the "theend_iv" path.
>
> Fixes: 06f751b61329 ("crypto: allwinner - Add sun8i-ce Crypto Engine")
> Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@xxxxxxxxx>
> ---
> drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
All applied. Thanks.
--
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
