crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx

The bounce buffers are allocated with __get_free_pages() using
BOUNCE_BUFFER_ORDER (order 2 = 4 pages), but both the allocation error
path and nx842_crypto_free_ctx() release the buffers with free_page().
Use free_pages() with the matching order instead.

Fixes: ed70b479c2c0 ("crypto: nx - add hardware 842 crypto comp alg")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/drivers/crypto/nx/nx-842.c b/drivers/crypto/nx/nx-842.c
index b61f2545e1652fd189d384f224d67e7999e1d36e..661568ce47f0e41686de2ebc73e203001578460c 100644 (file)
--- a/drivers/crypto/nx/nx-842.c
+++ b/drivers/crypto/nx/nx-842.c
@@ -116,8 +116,8 @@ void *nx842_crypto_alloc_ctx(struct nx842_driver *driver)
        ctx->dbounce = (u8 *)__get_free_pages(GFP_KERNEL, BOUNCE_BUFFER_ORDER);
        if (!ctx->wmem || !ctx->sbounce || !ctx->dbounce) {
                kfree(ctx->wmem);
-               free_page((unsigned long)ctx->sbounce);
-               free_page((unsigned long)ctx->dbounce);
+               free_pages((unsigned long)ctx->sbounce, BOUNCE_BUFFER_ORDER);
+               free_pages((unsigned long)ctx->dbounce, BOUNCE_BUFFER_ORDER);
                kfree(ctx);
                return ERR_PTR(-ENOMEM);
        }
@@ -131,8 +131,8 @@ void nx842_crypto_free_ctx(void *p)
        struct nx842_crypto_ctx *ctx = p;
 
        kfree(ctx->wmem);
-       free_page((unsigned long)ctx->sbounce);
-       free_page((unsigned long)ctx->dbounce);
+       free_pages((unsigned long)ctx->sbounce, BOUNCE_BUFFER_ORDER);
+       free_pages((unsigned long)ctx->dbounce, BOUNCE_BUFFER_ORDER);
 }
 EXPORT_SYMBOL_GPL(nx842_crypto_free_ctx);