From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1063431D757 for ; Sun, 24 May 2026 19:45:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779651954; cv=none; b=m2ERGX13wE+jIwET1KO7RV4wU0Bgol0zE0nrvWF2lqOlzBG5T7pWg70ncKKxzMtYaYmS0CLqqn2r7oIh2wky4x7t3JwsDfqc3GXMK2QVrcxH1gP8viwz+zgs6hIC93yj7OOPq/DQ5sCCcmDHhgoCk4xo23yRXZOAOvj0xOJH2pk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779651954; c=relaxed/simple; bh=4qw6UdagDB5Rg+pUwsg3VZ0z5i6gd9nT+MgXaEkbUrw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hUZEpwhhnrVwCS+NffIgGcgj8uiOK8I7wIuIIGP/nJ0T426LzRdXuGVb14L6cPEnyl/qN9JZJCDE72BSKEFU/a9bJ9dHRH/87S43dmqPSmPM2j/t2qOlPLF9QUxVsLQbi5aAwvWQyHqtfspBS+dh6qb+m7UMoqjc8+vYl7AEahs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Yzlo5mW+; arc=none smtp.client-ip=209.85.214.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Yzlo5mW+" Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2ba17c8cfacso94296435ad.2 for ; Sun, 24 May 2026 12:45:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779651951; x=1780256751; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=upvkT7BOTIVikHvpyUtlt+ZS5mn49ZMriQt2QIdU8EA=; b=Yzlo5mW+5FH8BD+LFnmSvrr6xDozUmMaBGTGvOcmbYFZbgRJiB1ZEtXeIe2SG+eQra ZQ0QgExWkbOtQcS8BeANEc2fRFnhT7bJ+lnlQ/Ez5uC98GXPFjxk+ED2euva9QDzIjD7 psd7Z0axbudpetd4WIjdXGzfyXlnFwqFWj5XdHwnNvXjabz7j3sJSpbfVZCcg7PQt1Yf 8pFxhJvw0jGoSXCAX8mzlTV13FbcS9/1SAcv/f7zr0Br9nYKJkrraIeKANbcFgWFuUDd F1uUkGZSPbknCgG+wb8KX/5EAXIxiUq4Ea4yPDkK1qBmKyfU0vNUgjmcI8TsG6K8iTvO VAYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779651951; x=1780256751; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=upvkT7BOTIVikHvpyUtlt+ZS5mn49ZMriQt2QIdU8EA=; b=Oro3u+Ou0cEydrCt4ElhArW6fe/Fpz8qqc72wXTKS7CaaudJuGnxIWDHBlBPUKgG0a tACNrkO4R7iFSKYzeG4gwZ88teTaUjDbwsbqs+DZfRSFHoguWev/TVBIYvnzhTbvHCYi 2kT9KMvC/qvC4ayvCWq5zr+h0Q3QIEGMhkgWTst2/ou4txv6Rv7cYO5yKu76J1PDPPa0 +QExdqpna6kMWD88pu8hJjp8wldtWQgRy7hOovvYuKxcaXthXN1lVXPgL2BCzLAwbUIB /UXhpzjppong7C0h0w+DW/EUd1R0adDhXOpylLkXPTO0zzCXB85DYzs20MMYfU8B5PsX WLhw== X-Forwarded-Encrypted: i=1; AFNElJ9mgG4yXUPxItGKGNjUVUgEn/3h5Wwzl6a2PcaqGxlJPBHhzyLys1KxZXsGEIF8RKEH6ogF5aOfaWmzvF4=@vger.kernel.org X-Gm-Message-State: AOJu0YwNVYtHWrf+OygHi0c3y0W+6WAcpYNuV3p0A2Tu8LRGCL3SYXAO kAquanQ+oogZdnz569bUHfU93B/NBDrDtd3RHn5QDMI6ScZbM6CF2e8T X-Gm-Gg: Acq92OEG2ato0FmOFhvDdUb/1hJ+bfizoyjz7mmhdNXtFDS0SLM5L4tQBVp1ib3m0Uv gD0cBB+pQbnSuvR52BkTGc90NuIr+Fz9AP29XS/Ox/Dj9TUz/Ja7GUfKjLaPsiKAtWrQwcV+bwq SKYbB22JRctWlMDIgGOOhpVW80ndbOdBS0x0v0aMIrN/RtA+G81IXjB9Kat+d4/mh3mUOnvepzN lHsHCIPiMtO8MAXGhrTMQ1Jzoy8O+KdDJ4d5sY4H6hd0KGqq27eLu+0VexoTxJz2PuC/ip/iRC8 KlHuYwGKfZ4obBcQX+dpLLatYFfnssQnHHSOZpsQvBDVCGGlzcWZvDUlhI6BCTNJ9r/X9+MRZpb d81nULcSsCHgqgWx+SQNkom5F3gpieRfs39x6cnuDZMWfVW/SzBGACfThYKpKoFATP9QhdUfiBE 7jmNtJyK8pIIGUsOnCtVi+TSHx X-Received: by 2002:a17:903:440f:b0:2b0:67a7:5c4b with SMTP id d9443c01a7336-2beb0603fbemr127850575ad.28.1779651950934; Sun, 24 May 2026 12:45:50 -0700 (PDT) Received: from mincom1 ([125.149.177.227]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2beb590aa7esm74414485ad.78.2026.05.24.12.45.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 24 May 2026 12:45:50 -0700 (PDT) From: Jihong Min To: Herbert Xu , linux-crypto@vger.kernel.org Cc: Christian Marangi , Antoine Tenart , "David S . Miller" , Richard van Schagen , linux-kernel@vger.kernel.org, Benjamin Larsson , Mieczyslaw Nalewaj , Aleksander Jan Bajkowski , Jihong Min Subject: [PATCH 2/6] crypto: eip93: guard DMA cleanup on uninitialized mappings Date: Mon, 25 May 2026 04:45:24 +0900 Message-ID: <20260524194528.3666383-3-hurryman2212@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260524194528.3666383-1-hurryman2212@gmail.com> References: <20260524194528.3666383-1-hurryman2212@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Several error paths can reach cleanup before all DMA addresses have been initialized or mapped. Initialize request DMA handles and check them before cleanup so the driver does not unmap zero or stale addresses. If mapping the temporary HMAC SA record fails, also release the block data DMA mapping that was already active. Fixes: 9739f5f93b78 ("crypto: eip93 - Add Inside Secure SafeXcel EIP-93 crypto engine support") Reported-by: Benjamin Larsson Originally-by: Mieczyslaw Nalewaj Suggested-by: Benjamin Larsson Assisted-by: Codex:gpt-5.5 Signed-off-by: Jihong Min --- .../crypto/inside-secure/eip93/eip93-common.c | 8 ++- .../crypto/inside-secure/eip93/eip93-hash.c | 54 ++++++++++++------- 2 files changed, 41 insertions(+), 21 deletions(-) diff --git a/drivers/crypto/inside-secure/eip93/eip93-common.c b/drivers/crypto/inside-secure/eip93/eip93-common.c index 4c163d7281b3..ed46730c36bc 100644 --- a/drivers/crypto/inside-secure/eip93/eip93-common.c +++ b/drivers/crypto/inside-secure/eip93/eip93-common.c @@ -527,6 +527,8 @@ int eip93_send_req(struct crypto_async_request *async, rctx->sa_state_ctr = NULL; rctx->sa_state = NULL; + rctx->sa_state_ctr_base = 0; + rctx->sa_state_base = 0; if (IS_ECB(flags)) goto skip_iv; @@ -534,8 +536,10 @@ int eip93_send_req(struct crypto_async_request *async, memcpy(iv, reqiv, rctx->ivsize); rctx->sa_state = kzalloc(sizeof(*rctx->sa_state), GFP_KERNEL); - if (!rctx->sa_state) - return -ENOMEM; + if (!rctx->sa_state) { + err = -ENOMEM; + goto free_sa_state; + } sa_state = rctx->sa_state; diff --git a/drivers/crypto/inside-secure/eip93/eip93-hash.c b/drivers/crypto/inside-secure/eip93/eip93-hash.c index 84d3ff2d3836..63bb6c4670cb 100644 --- a/drivers/crypto/inside-secure/eip93/eip93-hash.c +++ b/drivers/crypto/inside-secure/eip93/eip93-hash.c @@ -34,7 +34,7 @@ static void eip93_hash_free_data_blocks(struct ahash_request *req) if (!list_empty(&rctx->blocks)) INIT_LIST_HEAD(&rctx->blocks); - if (rctx->finalize) + if (rctx->finalize && rctx->data_dma) dma_unmap_single(eip93->dev, rctx->data_dma, rctx->data_used, DMA_TO_DEVICE); @@ -47,12 +47,13 @@ static void eip93_hash_free_sa_record(struct ahash_request *req) struct eip93_hash_ctx *ctx = crypto_ahash_ctx(ahash); struct eip93_device *eip93 = ctx->eip93; - if (IS_HMAC(ctx->flags)) + if (IS_HMAC(ctx->flags) && rctx->sa_record_hmac_base) dma_unmap_single(eip93->dev, rctx->sa_record_hmac_base, sizeof(rctx->sa_record_hmac), DMA_TO_DEVICE); - dma_unmap_single(eip93->dev, rctx->sa_record_base, - sizeof(rctx->sa_record), DMA_TO_DEVICE); + if (rctx->sa_record_base) + dma_unmap_single(eip93->dev, rctx->sa_record_base, + sizeof(rctx->sa_record), DMA_TO_DEVICE); } void eip93_hash_handle_result(struct crypto_async_request *async, int err) @@ -66,8 +67,9 @@ void eip93_hash_handle_result(struct crypto_async_request *async, int err) struct eip93_device *eip93 = ctx->eip93; int i; - dma_unmap_single(eip93->dev, rctx->sa_state_base, - sizeof(*sa_state), DMA_FROM_DEVICE); + if (rctx->sa_state_base) + dma_unmap_single(eip93->dev, rctx->sa_state_base, + sizeof(*sa_state), DMA_FROM_DEVICE); /* * With partial_hash assume SHA256_DIGEST_SIZE buffer is passed. @@ -200,6 +202,10 @@ static void __eip93_hash_init(struct ahash_request *req) rctx->len = 0; rctx->data_used = 0; + rctx->sa_record_base = 0; + rctx->sa_state_base = 0; + rctx->sa_record_hmac_base = 0; + rctx->data_dma = 0; rctx->partial_hash = false; rctx->finalize = false; INIT_LIST_HEAD(&rctx->blocks); @@ -250,8 +256,12 @@ static int eip93_send_hash_req(struct crypto_async_request *async, u8 *data, sizeof(*sa_record_hmac), DMA_TO_DEVICE); ret = dma_mapping_error(eip93->dev, rctx->sa_record_hmac_base); - if (ret) + if (ret) { + rctx->sa_record_hmac_base = 0; + dma_unmap_single(eip93->dev, src_addr, len, + DMA_TO_DEVICE); return ret; + } cdesc.sa_addr = rctx->sa_record_hmac_base; } @@ -420,12 +430,14 @@ static int eip93_hash_update(struct ahash_request *req) return ret; free_sa_record: - dma_unmap_single(eip93->dev, rctx->sa_record_base, - sizeof(*sa_record), DMA_TO_DEVICE); + if (rctx->sa_record_base) + dma_unmap_single(eip93->dev, rctx->sa_record_base, + sizeof(*sa_record), DMA_TO_DEVICE); free_sa_state: - dma_unmap_single(eip93->dev, rctx->sa_state_base, - sizeof(*sa_state), DMA_TO_DEVICE); + if (rctx->sa_state_base) + dma_unmap_single(eip93->dev, rctx->sa_state_base, + sizeof(*sa_state), DMA_TO_DEVICE); return ret; } @@ -501,12 +513,14 @@ static int __eip93_hash_final(struct ahash_request *req, bool map_dma) free_blocks: eip93_hash_free_data_blocks(req); - dma_unmap_single(eip93->dev, rctx->sa_record_base, - sizeof(*sa_record), DMA_TO_DEVICE); + if (rctx->sa_record_base) + dma_unmap_single(eip93->dev, rctx->sa_record_base, + sizeof(*sa_record), DMA_TO_DEVICE); free_sa_state: - dma_unmap_single(eip93->dev, rctx->sa_state_base, - sizeof(*sa_state), DMA_TO_DEVICE); + if (rctx->sa_state_base) + dma_unmap_single(eip93->dev, rctx->sa_state_base, + sizeof(*sa_state), DMA_TO_DEVICE); return ret; } @@ -549,11 +563,13 @@ static int eip93_hash_finup(struct ahash_request *req) return __eip93_hash_final(req, false); free_sa_record: - dma_unmap_single(eip93->dev, rctx->sa_record_base, - sizeof(*sa_record), DMA_TO_DEVICE); + if (rctx->sa_record_base) + dma_unmap_single(eip93->dev, rctx->sa_record_base, + sizeof(*sa_record), DMA_TO_DEVICE); free_sa_state: - dma_unmap_single(eip93->dev, rctx->sa_state_base, - sizeof(*sa_state), DMA_TO_DEVICE); + if (rctx->sa_state_base) + dma_unmap_single(eip93->dev, rctx->sa_state_base, + sizeof(*sa_state), DMA_TO_DEVICE); return ret; } -- 2.53.0