--- /dev/null
+From e17ff3d6ff907dc8406261e8fd3e1fc8a908f0f6 Mon Sep 17 00:00:00 2001
+From: Paul Louvel <paul.louvel@bootlin.com>
+Date: Thu, 7 May 2026 16:41:47 +0200
+Subject: crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
+
+From: Paul Louvel <paul.louvel@bootlin.com>
+
+commit e17ff3d6ff907dc8406261e8fd3e1fc8a908f0f6 upstream.
+
+In order to know if a descriptor has been processed by the device,
+the driver polls the FIFO to see if DESC_HDR_DONE is set on a descriptor
+header to confirm completion.
+The current code does not make sure that the CPU gets up to date data
+before reading the descriptor.
+
+Fix this by calling dma_sync_single_for_cpu() before reading memory
+written by the device.
+
+Cc: stable@vger.kernel.org
+Fixes: 58cdbc6d2263 ("crypto: talitos - fix hash on SEC1.")
+Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/talitos.c | 28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -320,19 +320,31 @@ static int talitos_submit(struct device
+ return -EINPROGRESS;
+ }
+
+-static __be32 get_request_hdr(struct talitos_request *request, bool is_sec1)
++static __be32 get_request_hdr(struct device *dev,
++ struct talitos_request *request, bool is_sec1)
+ {
+ struct talitos_edesc *edesc;
+
+- if (!is_sec1)
++ if (!is_sec1) {
++ dma_sync_single_for_cpu(dev, request->dma_desc,
++ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
++
+ return request->desc->hdr;
++ }
+
+- if (!request->desc->next_desc)
++ if (!request->desc->next_desc) {
++ dma_sync_single_for_cpu(dev, request->dma_desc,
++ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
+ return request->desc->hdr1;
+-
+- edesc = container_of(request->desc, struct talitos_edesc, desc);
+-
+- return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))->hdr1;
++ } else {
++ dma_sync_single_for_cpu(dev,
++ be32_to_cpu(request->desc->next_desc),
++ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
++ edesc = container_of(request->desc, struct talitos_edesc, desc);
++
++ return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))
++ ->hdr1;
++ }
+ }
+
+ /*
+@@ -356,7 +368,7 @@ static void flush_channel(struct device
+
+ /* descriptors with their done bits set don't get the error */
+ rmb();
+- hdr = get_request_hdr(request, is_sec1);
++ hdr = get_request_hdr(dev, request, is_sec1);
+
+ if ((hdr & DESC_HDR_DONE) == DESC_HDR_DONE)
+ status = 0;
crypto-drbg-fix-returning-success-on-failure-in-ctr_drbg.patch
crypto-drbg-fix-drbg_max_addtl-on-64-bit-kernels.patch
crypto-drbg-fix-the-fips_enabled-priority-boost.patch
+crypto-talitos-use-dma_sync_single_for_cpu-before-reading-descriptor-header.patch
+spi-fsl-lpspi-replace-dmaengine_terminate_all-with-dmaengine_terminate_sync.patch
+spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch
--- /dev/null
+From e703ce47691b967fe9b4057fb1d062273211afa9 Mon Sep 17 00:00:00 2001
+From: Carlos Song <carlos.song@nxp.com>
+Date: Mon, 25 May 2026 14:23:56 +0800
+Subject: spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
+
+From: Carlos Song <carlos.song@nxp.com>
+
+commit e703ce47691b967fe9b4057fb1d062273211afa9 upstream.
+
+dmaengine_terminate_all() has been deprecated, so replace it with
+dmaengine_terminate_sync().
+
+Fixes: 09c04466ce7e ("spi: lpspi: add dma mode support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Carlos Song <carlos.song@nxp.com>
+Link: https://patch.msgid.link/20260525062357.3191349-2-carlos.song@oss.nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -577,7 +577,7 @@ static int fsl_lpspi_dma_transfer(struct
+ tx->sgl, tx->nents, DMA_MEM_TO_DEV,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_tx) {
+- dmaengine_terminate_all(controller->dma_tx);
++ dmaengine_terminate_sync(controller->dma_tx);
+ return -EINVAL;
+ }
+
+@@ -598,8 +598,8 @@ static int fsl_lpspi_dma_transfer(struct
+ transfer_timeout);
+ if (!timeout) {
+ dev_err(fsl_lpspi->dev, "I/O Error in DMA TX\n");
+- dmaengine_terminate_all(controller->dma_tx);
+- dmaengine_terminate_all(controller->dma_rx);
++ dmaengine_terminate_sync(controller->dma_tx);
++ dmaengine_terminate_sync(controller->dma_rx);
+ fsl_lpspi_reset(fsl_lpspi);
+ return -ETIMEDOUT;
+ }
+@@ -608,8 +608,8 @@ static int fsl_lpspi_dma_transfer(struct
+ transfer_timeout);
+ if (!timeout) {
+ dev_err(fsl_lpspi->dev, "I/O Error in DMA RX\n");
+- dmaengine_terminate_all(controller->dma_tx);
+- dmaengine_terminate_all(controller->dma_rx);
++ dmaengine_terminate_sync(controller->dma_tx);
++ dmaengine_terminate_sync(controller->dma_rx);
+ fsl_lpspi_reset(fsl_lpspi);
+ return -ETIMEDOUT;
+ }
+@@ -618,8 +618,8 @@ static int fsl_lpspi_dma_transfer(struct
+ fsl_lpspi->slave_aborted) {
+ dev_dbg(fsl_lpspi->dev,
+ "I/O Error in DMA TX interrupted\n");
+- dmaengine_terminate_all(controller->dma_tx);
+- dmaengine_terminate_all(controller->dma_rx);
++ dmaengine_terminate_sync(controller->dma_tx);
++ dmaengine_terminate_sync(controller->dma_rx);
+ fsl_lpspi_reset(fsl_lpspi);
+ return -EINTR;
+ }
+@@ -628,8 +628,8 @@ static int fsl_lpspi_dma_transfer(struct
+ fsl_lpspi->slave_aborted) {
+ dev_dbg(fsl_lpspi->dev,
+ "I/O Error in DMA RX interrupted\n");
+- dmaengine_terminate_all(controller->dma_tx);
+- dmaengine_terminate_all(controller->dma_rx);
++ dmaengine_terminate_sync(controller->dma_tx);
++ dmaengine_terminate_sync(controller->dma_rx);
+ fsl_lpspi_reset(fsl_lpspi);
+ return -EINTR;
+ }
--- /dev/null
+From 01980b5da56e573d62798d0ff6c86bcaa2b22cbe Mon Sep 17 00:00:00 2001
+From: Carlos Song <carlos.song@nxp.com>
+Date: Mon, 25 May 2026 14:23:57 +0800
+Subject: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
+
+From: Carlos Song <carlos.song@nxp.com>
+
+commit 01980b5da56e573d62798d0ff6c86bcaa2b22cbe upstream.
+
+When dmaengine_prep_slave_sg() fails for the TX channel, the error path
+terminates the TX DMA channel but leaves the RX channel running. Since
+the RX channel was already submitted and issued prior to preparing
+the TX descriptor, returning -EINVAL causes the SPI core to unmap the
+DMA buffers while the RX DMA engine continues writing to them, leading
+to potential memory corruption or use-after-free.
+
+Terminate the RX channel before returning on the TX prepare failure path.
+
+Fixes: 09c04466ce7e ("spi: lpspi: add dma mode support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Carlos Song <carlos.song@nxp.com>
+Link: https://patch.msgid.link/20260525062357.3191349-3-carlos.song@oss.nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -577,7 +577,7 @@ static int fsl_lpspi_dma_transfer(struct
+ tx->sgl, tx->nents, DMA_MEM_TO_DEV,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_tx) {
+- dmaengine_terminate_sync(controller->dma_tx);
++ dmaengine_terminate_sync(controller->dma_rx);
+ return -EINVAL;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
