releases/4.11.2/crypto-s5p-sss-close-possible-race-for-completed-requests.patch

   1 From 42d5c176b76e190a4a3e0dfeffdae661755955b6 Mon Sep 17 00:00:00 2001
   2 From: Krzysztof Kozlowski <krzk@kernel.org>
   3 Date: Fri, 17 Mar 2017 16:49:19 +0200
   4 Subject: crypto: s5p-sss - Close possible race for completed requests
   5
   6 From: Krzysztof Kozlowski <krzk@kernel.org>
   7
   8 commit 42d5c176b76e190a4a3e0dfeffdae661755955b6 upstream.
   9
  10 Driver is capable of handling only one request at a time and it stores
  11 it in its state container struct s5p_aes_dev.  This stored request must be
  12 protected between concurrent invocations (e.g. completing current
  13 request and scheduling new one).  Combination of lock and "busy" field
  14 is used for that purpose.
  15
  16 When "busy" field is true, the driver will not accept new request thus
  17 it will not overwrite currently handled data.
  18
  19 However commit 28b62b145868 ("crypto: s5p-sss - Fix spinlock recursion
  20 on LRW(AES)") moved some of the write to "busy" field out of a lock
  21 protected critical section.  This might lead to potential race between
  22 completing current request and scheduling a new one.  Effectively the
  23 request completion might try to operate on new crypto request.
  24
  25 Fixes: 28b62b145868 ("crypto: s5p-sss - Fix spinlock recursion on LRW(AES)")
  26 Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
  27 Reviewed-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
  28 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  29 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  30
  31 ---
  32  drivers/crypto/s5p-sss.c |    5 +++--
  33  1 file changed, 3 insertions(+), 2 deletions(-)
  34
  35 --- a/drivers/crypto/s5p-sss.c
  36 +++ b/drivers/crypto/s5p-sss.c
  37 @@ -287,7 +287,6 @@ static void s5p_sg_done(struct s5p_aes_d
  38  static void s5p_aes_complete(struct s5p_aes_dev *dev, int err)
  39  {
  40         dev->req->base.complete(&dev->req->base, err);
  41 -       dev->busy = false;
  42  }
  43
  44  static void s5p_unset_outdata(struct s5p_aes_dev *dev)
  45 @@ -462,7 +461,7 @@ static irqreturn_t s5p_aes_interrupt(int
  46                 spin_unlock_irqrestore(&dev->lock, flags);
  47
  48                 s5p_aes_complete(dev, 0);
  49 -               dev->busy = true;
  50 +               /* Device is still busy */
  51                 tasklet_schedule(&dev->tasklet);
  52         } else {
  53                 /*
  54 @@ -483,6 +482,7 @@ static irqreturn_t s5p_aes_interrupt(int
  55
  56  error:
  57         s5p_sg_done(dev);
  58 +       dev->busy = false;
  59         spin_unlock_irqrestore(&dev->lock, flags);
  60         s5p_aes_complete(dev, err);
  61
  62 @@ -634,6 +634,7 @@ outdata_error:
  63
  64  indata_error:
  65         s5p_sg_done(dev);
  66 +       dev->busy = false;
  67         spin_unlock_irqrestore(&dev->lock, flags);
  68         s5p_aes_complete(dev, err);
  69  }