From: Greg Kroah-Hartman Date: Wed, 15 Jul 2026 10:34:40 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=83cbfbbbb819d82c8a66dd0d0d673a1194d93dbb;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: crypto-talitos-use-dma_sync_single_for_cpu-before-reading-descriptor-header.patch spi-fsl-lpspi-replace-dmaengine_terminate_all-with-dmaengine_terminate_sync.patch spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch --- diff --git a/queue-5.15/crypto-talitos-use-dma_sync_single_for_cpu-before-reading-descriptor-header.patch b/queue-5.15/crypto-talitos-use-dma_sync_single_for_cpu-before-reading-descriptor-header.patch new file mode 100644 index 0000000000..303d635a62 --- /dev/null +++ b/queue-5.15/crypto-talitos-use-dma_sync_single_for_cpu-before-reading-descriptor-header.patch @@ -0,0 +1,77 @@ +From e17ff3d6ff907dc8406261e8fd3e1fc8a908f0f6 Mon Sep 17 00:00:00 2001 +From: Paul Louvel +Date: Thu, 7 May 2026 16:41:47 +0200 +Subject: crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header + +From: Paul Louvel + +commit e17ff3d6ff907dc8406261e8fd3e1fc8a908f0f6 upstream. + +In order to know if a descriptor has been processed by the device, +the driver polls the FIFO to see if DESC_HDR_DONE is set on a descriptor +header to confirm completion. +The current code does not make sure that the CPU gets up to date data +before reading the descriptor. + +Fix this by calling dma_sync_single_for_cpu() before reading memory +written by the device. + +Cc: stable@vger.kernel.org +Fixes: 58cdbc6d2263 ("crypto: talitos - fix hash on SEC1.") +Signed-off-by: Paul Louvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/talitos.c | 28 ++++++++++++++++++++-------- + 1 file changed, 20 insertions(+), 8 deletions(-) + +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -321,19 +321,31 @@ static int talitos_submit(struct device + return -EINPROGRESS; + } + +-static __be32 get_request_hdr(struct talitos_request *request, bool is_sec1) ++static __be32 get_request_hdr(struct device *dev, ++ struct talitos_request *request, bool is_sec1) + { + struct talitos_edesc *edesc; + +- if (!is_sec1) ++ if (!is_sec1) { ++ dma_sync_single_for_cpu(dev, request->dma_desc, ++ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL); ++ + return request->desc->hdr; ++ } + +- if (!request->desc->next_desc) ++ if (!request->desc->next_desc) { ++ dma_sync_single_for_cpu(dev, request->dma_desc, ++ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL); + return request->desc->hdr1; +- +- edesc = container_of(request->desc, struct talitos_edesc, desc); +- +- return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))->hdr1; ++ } else { ++ dma_sync_single_for_cpu(dev, ++ be32_to_cpu(request->desc->next_desc), ++ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL); ++ edesc = container_of(request->desc, struct talitos_edesc, desc); ++ ++ return ((struct talitos_desc *)(edesc->buf + edesc->dma_len)) ++ ->hdr1; ++ } + } + + /* +@@ -357,7 +369,7 @@ static void flush_channel(struct device + + /* descriptors with their done bits set don't get the error */ + rmb(); +- hdr = get_request_hdr(request, is_sec1); ++ hdr = get_request_hdr(dev, request, is_sec1); + + if ((hdr & DESC_HDR_DONE) == DESC_HDR_DONE) + status = 0; diff --git a/queue-5.15/series b/queue-5.15/series index 189fc86d1c..9ce494b296 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -167,3 +167,6 @@ crypto-pcrypt-restore-callback-for-non-parallel-fallback.patch crypto-drbg-fix-returning-success-on-failure-in-ctr_drbg.patch crypto-drbg-fix-drbg_max_addtl-on-64-bit-kernels.patch crypto-drbg-fix-the-fips_enabled-priority-boost.patch +crypto-talitos-use-dma_sync_single_for_cpu-before-reading-descriptor-header.patch +spi-fsl-lpspi-replace-dmaengine_terminate_all-with-dmaengine_terminate_sync.patch +spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch diff --git a/queue-5.15/spi-fsl-lpspi-replace-dmaengine_terminate_all-with-dmaengine_terminate_sync.patch b/queue-5.15/spi-fsl-lpspi-replace-dmaengine_terminate_all-with-dmaengine_terminate_sync.patch new file mode 100644 index 0000000000..e4607f942e --- /dev/null +++ b/queue-5.15/spi-fsl-lpspi-replace-dmaengine_terminate_all-with-dmaengine_terminate_sync.patch @@ -0,0 +1,77 @@ +From e703ce47691b967fe9b4057fb1d062273211afa9 Mon Sep 17 00:00:00 2001 +From: Carlos Song +Date: Mon, 25 May 2026 14:23:56 +0800 +Subject: spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() + +From: Carlos Song + +commit e703ce47691b967fe9b4057fb1d062273211afa9 upstream. + +dmaengine_terminate_all() has been deprecated, so replace it with +dmaengine_terminate_sync(). + +Fixes: 09c04466ce7e ("spi: lpspi: add dma mode support") +Cc: stable@vger.kernel.org +Signed-off-by: Carlos Song +Link: https://patch.msgid.link/20260525062357.3191349-2-carlos.song@oss.nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-fsl-lpspi.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -577,7 +577,7 @@ static int fsl_lpspi_dma_transfer(struct + tx->sgl, tx->nents, DMA_MEM_TO_DEV, + DMA_PREP_INTERRUPT | DMA_CTRL_ACK); + if (!desc_tx) { +- dmaengine_terminate_all(controller->dma_tx); ++ dmaengine_terminate_sync(controller->dma_tx); + return -EINVAL; + } + +@@ -598,8 +598,8 @@ static int fsl_lpspi_dma_transfer(struct + transfer_timeout); + if (!timeout) { + dev_err(fsl_lpspi->dev, "I/O Error in DMA TX\n"); +- dmaengine_terminate_all(controller->dma_tx); +- dmaengine_terminate_all(controller->dma_rx); ++ dmaengine_terminate_sync(controller->dma_tx); ++ dmaengine_terminate_sync(controller->dma_rx); + fsl_lpspi_reset(fsl_lpspi); + return -ETIMEDOUT; + } +@@ -608,8 +608,8 @@ static int fsl_lpspi_dma_transfer(struct + transfer_timeout); + if (!timeout) { + dev_err(fsl_lpspi->dev, "I/O Error in DMA RX\n"); +- dmaengine_terminate_all(controller->dma_tx); +- dmaengine_terminate_all(controller->dma_rx); ++ dmaengine_terminate_sync(controller->dma_tx); ++ dmaengine_terminate_sync(controller->dma_rx); + fsl_lpspi_reset(fsl_lpspi); + return -ETIMEDOUT; + } +@@ -618,8 +618,8 @@ static int fsl_lpspi_dma_transfer(struct + fsl_lpspi->slave_aborted) { + dev_dbg(fsl_lpspi->dev, + "I/O Error in DMA TX interrupted\n"); +- dmaengine_terminate_all(controller->dma_tx); +- dmaengine_terminate_all(controller->dma_rx); ++ dmaengine_terminate_sync(controller->dma_tx); ++ dmaengine_terminate_sync(controller->dma_rx); + fsl_lpspi_reset(fsl_lpspi); + return -EINTR; + } +@@ -628,8 +628,8 @@ static int fsl_lpspi_dma_transfer(struct + fsl_lpspi->slave_aborted) { + dev_dbg(fsl_lpspi->dev, + "I/O Error in DMA RX interrupted\n"); +- dmaengine_terminate_all(controller->dma_tx); +- dmaengine_terminate_all(controller->dma_rx); ++ dmaengine_terminate_sync(controller->dma_tx); ++ dmaengine_terminate_sync(controller->dma_rx); + fsl_lpspi_reset(fsl_lpspi); + return -EINTR; + } diff --git a/queue-5.15/spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch b/queue-5.15/spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch new file mode 100644 index 0000000000..0e90b908c4 --- /dev/null +++ b/queue-5.15/spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch @@ -0,0 +1,39 @@ +From 01980b5da56e573d62798d0ff6c86bcaa2b22cbe Mon Sep 17 00:00:00 2001 +From: Carlos Song +Date: Mon, 25 May 2026 14:23:57 +0800 +Subject: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path + +From: Carlos Song + +commit 01980b5da56e573d62798d0ff6c86bcaa2b22cbe upstream. + +When dmaengine_prep_slave_sg() fails for the TX channel, the error path +terminates the TX DMA channel but leaves the RX channel running. Since +the RX channel was already submitted and issued prior to preparing +the TX descriptor, returning -EINVAL causes the SPI core to unmap the +DMA buffers while the RX DMA engine continues writing to them, leading +to potential memory corruption or use-after-free. + +Terminate the RX channel before returning on the TX prepare failure path. + +Fixes: 09c04466ce7e ("spi: lpspi: add dma mode support") +Cc: stable@vger.kernel.org +Signed-off-by: Carlos Song +Link: https://patch.msgid.link/20260525062357.3191349-3-carlos.song@oss.nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-fsl-lpspi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -577,7 +577,7 @@ static int fsl_lpspi_dma_transfer(struct + tx->sgl, tx->nents, DMA_MEM_TO_DEV, + DMA_PREP_INTERRUPT | DMA_CTRL_ACK); + if (!desc_tx) { +- dmaengine_terminate_sync(controller->dma_tx); ++ dmaengine_terminate_sync(controller->dma_rx); + return -EINVAL; + } +