crypto: ccree - fix free of unallocated mlli buffer

commit a49411959ea6d4915a9fd2a7eb5ba220e6284e9a upstream.

In cc_unmap_aead_request(), call dma_pool_free() for mlli buffer only
if an item is allocated from the pool and not always if there is a
pool allocated.
This fixes a kernel panic when trying to free a non-allocated item.

Cc: stable@vger.kernel.org
Signed-off-by: Hadar Gat <hadar.gat@arm.com>
Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c
index dd948e1df9e5c5a8f2aac0dba9aacfa87a0f5aa6..3bcb6bce666e358a5adc105090c53fe49b69348b 100644 (file)
--- a/drivers/crypto/ccree/cc_buffer_mgr.c
+++ b/drivers/crypto/ccree/cc_buffer_mgr.c
@@ -614,10 +614,10 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req)
                                 hw_iv_size, DMA_BIDIRECTIONAL);
        }
 
-       /*In case a pool was set, a table was
-        *allocated and should be released
-        */
-       if (areq_ctx->mlli_params.curr_pool) {
+       /* Release pool */
+       if ((areq_ctx->assoc_buff_type == CC_DMA_BUF_MLLI ||
+            areq_ctx->data_buff_type == CC_DMA_BUF_MLLI) &&
+           (areq_ctx->mlli_params.mlli_virt_addr)) {
                dev_dbg(dev, "free MLLI buffer: dma=%pad virt=%pK\n",
                        &areq_ctx->mlli_params.mlli_dma_addr,
                        areq_ctx->mlli_params.mlli_virt_addr);