* [PATCH] crypto: hisilicon/hpre - fix unmapping invalid dma address
@ 2021-04-10 9:49 Hui Tang
2021-04-16 11:26 ` Herbert Xu
0 siblings, 1 reply; 3+ messages in thread
From: Hui Tang @ 2021-04-10 9:49 UTC (permalink / raw)
To: herbert, davem; +Cc: linux-crypto, xuzaibo, wangzhou1, linux-kernel
Currently, an invalid dma address may be unmapped when calling
'xx_data_clr_all' in error path, so check dma address of sqe in/out
whether it has been mapped before calling 'dma_free_coherent' or
'dma_unmap_single'.
An abnormal case is as follows:
hpre_curve25519_compute_value
-> hpre_curve25519_src_init
-> hpre_curve25519_hw_data_clr_all
Fixes: a9214b0b6ed2(crypto: hisilicon - fix the check on dma address)
Signed-off-by: Hui Tang <tanghui20@huawei.com>
---
drivers/crypto/hisilicon/hpre/hpre_crypto.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
index f363653..d23893a 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
@@ -298,6 +298,8 @@ static void hpre_hw_data_clr_all(struct hpre_ctx *ctx,
dma_addr_t tmp;
tmp = le64_to_cpu(sqe->in);
+ if (unlikely(dma_mapping_error(dev, tmp)))
+ return;
if (src) {
if (req->src)
@@ -307,6 +309,8 @@ static void hpre_hw_data_clr_all(struct hpre_ctx *ctx,
}
tmp = le64_to_cpu(sqe->out);
+ if (unlikely(dma_mapping_error(dev, tmp)))
+ return;
if (req->dst) {
if (dst)
@@ -517,6 +521,8 @@ static int hpre_msg_request_set(struct hpre_ctx *ctx, void *req, bool is_rsa)
msg->key = cpu_to_le64(ctx->dh.dma_xa_p);
}
+ msg->in = DMA_MAPPING_ERROR;
+ msg->out = DMA_MAPPING_ERROR;
msg->dw0 |= cpu_to_le32(0x1 << HPRE_SQE_DONE_SHIFT);
msg->task_len1 = (ctx->key_sz >> HPRE_BITS_2_BYTES_SHIFT) - 1;
h_req->ctx = ctx;
@@ -1365,11 +1371,15 @@ static void hpre_ecdh_hw_data_clr_all(struct hpre_ctx *ctx,
dma_addr_t dma;
dma = le64_to_cpu(sqe->in);
+ if (unlikely(dma_mapping_error(dev, dma)))
+ return;
if (src && req->src)
dma_free_coherent(dev, ctx->key_sz << 2, req->src, dma);
dma = le64_to_cpu(sqe->out);
+ if (unlikely(dma_mapping_error(dev, dma)))
+ return;
if (req->dst)
dma_free_coherent(dev, ctx->key_sz << 1, req->dst, dma);
@@ -1424,6 +1434,8 @@ static int hpre_ecdh_msg_request_set(struct hpre_ctx *ctx,
h_req->areq.ecdh = req;
msg = &h_req->req;
memset(msg, 0, sizeof(*msg));
+ msg->in = DMA_MAPPING_ERROR;
+ msg->out = DMA_MAPPING_ERROR;
msg->key = cpu_to_le64(ctx->ecdh.dma_p);
msg->dw0 |= cpu_to_le32(0x1U << HPRE_SQE_DONE_SHIFT);
@@ -1660,11 +1672,15 @@ static void hpre_curve25519_hw_data_clr_all(struct hpre_ctx *ctx,
dma_addr_t dma;
dma = le64_to_cpu(sqe->in);
+ if (unlikely(dma_mapping_error(dev, dma)))
+ return;
if (src && req->src)
dma_free_coherent(dev, ctx->key_sz, req->src, dma);
dma = le64_to_cpu(sqe->out);
+ if (unlikely(dma_mapping_error(dev, dma)))
+ return;
if (req->dst)
dma_free_coherent(dev, ctx->key_sz, req->dst, dma);
@@ -1715,6 +1731,8 @@ static int hpre_curve25519_msg_request_set(struct hpre_ctx *ctx,
h_req->areq.curve25519 = req;
msg = &h_req->req;
memset(msg, 0, sizeof(*msg));
+ msg->in = DMA_MAPPING_ERROR;
+ msg->out = DMA_MAPPING_ERROR;
msg->key = cpu_to_le64(ctx->curve25519.dma_p);
msg->dw0 |= cpu_to_le32(0x1U << HPRE_SQE_DONE_SHIFT);
--
2.8.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] crypto: hisilicon/hpre - fix unmapping invalid dma address
2021-04-10 9:49 [PATCH] crypto: hisilicon/hpre - fix unmapping invalid dma address Hui Tang
@ 2021-04-16 11:26 ` Herbert Xu
2021-04-19 11:50 ` Hui Tang
0 siblings, 1 reply; 3+ messages in thread
From: Herbert Xu @ 2021-04-16 11:26 UTC (permalink / raw)
To: Hui Tang; +Cc: davem, linux-crypto, xuzaibo, wangzhou1, linux-kernel
On Sat, Apr 10, 2021 at 05:49:17PM +0800, Hui Tang wrote:
> Currently, an invalid dma address may be unmapped when calling
> 'xx_data_clr_all' in error path, so check dma address of sqe in/out
> whether it has been mapped before calling 'dma_free_coherent' or
> 'dma_unmap_single'.
>
> An abnormal case is as follows:
> hpre_curve25519_compute_value
> -> hpre_curve25519_src_init
> -> hpre_curve25519_hw_data_clr_all
>
> Fixes: a9214b0b6ed2(crypto: hisilicon - fix the check on dma address)
> Signed-off-by: Hui Tang <tanghui20@huawei.com>
> ---
> drivers/crypto/hisilicon/hpre/hpre_crypto.c | 18 ++++++++++++++++++
> 1 file changed, 18 insertions(+)
This triggers new sparse warnings.
Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] crypto: hisilicon/hpre - fix unmapping invalid dma address
2021-04-16 11:26 ` Herbert Xu
@ 2021-04-19 11:50 ` Hui Tang
0 siblings, 0 replies; 3+ messages in thread
From: Hui Tang @ 2021-04-19 11:50 UTC (permalink / raw)
To: Herbert Xu; +Cc: davem, linux-crypto, xuzaibo, wangzhou1, linux-kernel
On 2021/4/16 19:26, Herbert Xu wrote:
> On Sat, Apr 10, 2021 at 05:49:17PM +0800, Hui Tang wrote:
>> Currently, an invalid dma address may be unmapped when calling
>> 'xx_data_clr_all' in error path, so check dma address of sqe in/out
>> whether it has been mapped before calling 'dma_free_coherent' or
>> 'dma_unmap_single'.
>>
>> An abnormal case is as follows:
>> hpre_curve25519_compute_value
>> -> hpre_curve25519_src_init
>> -> hpre_curve25519_hw_data_clr_all
>>
>> Fixes: a9214b0b6ed2(crypto: hisilicon - fix the check on dma address)
>> Signed-off-by: Hui Tang <tanghui20@huawei.com>
>> ---
>> drivers/crypto/hisilicon/hpre/hpre_crypto.c | 18 ++++++++++++++++++
>> 1 file changed, 18 insertions(+)
>
> This triggers new sparse warnings.
Thanks, I will fix it in 5.13 rc1.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-04-19 11:50 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-10 9:49 [PATCH] crypto: hisilicon/hpre - fix unmapping invalid dma address Hui Tang
2021-04-16 11:26 ` Herbert Xu
2021-04-19 11:50 ` Hui Tang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).