releases/4.9.28/crypto-caam-fix-error-path-for-ctx_dma-mapping-failure.patch

   1 From 87ec02e7409d787348c244039aa3536a812dfa8b Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Horia=20Geant=C4=83?= <horia.geanta@nxp.com>
   3 Date: Fri, 10 Feb 2017 14:07:23 +0200
   4 Subject: crypto: caam - fix error path for ctx_dma mapping failure
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 From: Horia Geantă <horia.geanta@nxp.com>
  10
  11 commit 87ec02e7409d787348c244039aa3536a812dfa8b upstream.
  12
  13 In case ctx_dma dma mapping fails, ahash_unmap_ctx() tries to
  14 dma unmap an invalid address:
  15 map_seq_out_ptr_ctx() / ctx_map_to_sec4_sg() -> goto unmap_ctx ->
  16 -> ahash_unmap_ctx() -> dma unmap ctx_dma
  17
  18 There is also possible to reach ahash_unmap_ctx() with ctx_dma
  19 uninitialzed or to try to unmap the same address twice.
  20
  21 Fix these by setting ctx_dma = 0 where needed:
  22 -initialize ctx_dma in ahash_init()
  23 -clear ctx_dma in case of mapping error (instead of holding
  24 the error code returned by the dma map function)
  25 -clear ctx_dma after each unmapping
  26
  27 Fixes: 32686d34f8fb6 ("crypto: caam - ensure that we clean up after an error")
  28 Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
  29 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  30 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  31
  32 ---
  33  drivers/crypto/caam/caamhash.c |    7 ++++++-
  34  1 file changed, 6 insertions(+), 1 deletion(-)
  35
  36 --- a/drivers/crypto/caam/caamhash.c
  37 +++ b/drivers/crypto/caam/caamhash.c
  38 @@ -154,6 +154,7 @@ static inline int map_seq_out_ptr_ctx(u3
  39                                         ctx_len, DMA_FROM_DEVICE);
  40         if (dma_mapping_error(jrdev, state->ctx_dma)) {
  41                 dev_err(jrdev, "unable to map ctx\n");
  42 +               state->ctx_dma = 0;
  43                 return -ENOMEM;
  44         }
  45
  46 @@ -214,6 +215,7 @@ static inline int ctx_map_to_sec4_sg(u32
  47         state->ctx_dma = dma_map_single(jrdev, state->caam_ctx, ctx_len, flag);
  48         if (dma_mapping_error(jrdev, state->ctx_dma)) {
  49                 dev_err(jrdev, "unable to map ctx\n");
  50 +               state->ctx_dma = 0;
  51                 return -ENOMEM;
  52         }
  53
  54 @@ -620,8 +622,10 @@ static inline void ahash_unmap_ctx(struc
  55         struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash);
  56         struct caam_hash_state *state = ahash_request_ctx(req);
  57
  58 -       if (state->ctx_dma)
  59 +       if (state->ctx_dma) {
  60                 dma_unmap_single(dev, state->ctx_dma, ctx->ctx_len, flag);
  61 +               state->ctx_dma = 0;
  62 +       }
  63         ahash_unmap(dev, edesc, req, dst_len);
  64  }
  65
  66 @@ -1605,6 +1609,7 @@ static int ahash_init(struct ahash_reque
  67         state->finup = ahash_finup_first;
  68         state->final = ahash_final_no_ctx;
  69
  70 +       state->ctx_dma = 0;
  71         state->current_buf = 0;
  72         state->buf_dma = 0;
  73         state->buflen_0 = 0;