]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
crypto: tegra - Fix dma_free_coherent size error
authorHerbert Xu <herbert@gondor.apana.org.au>
Tue, 19 May 2026 04:22:18 +0000 (12:22 +0800)
committerHerbert Xu <herbert@gondor.apana.org.au>
Fri, 29 May 2026 05:54:43 +0000 (13:54 +0800)
When freeing a coherent DMA buffer, the size must match the value
that was used during the allocation.

Unfortunately the size field in the tegra driver gets overwritten
by this point so it no longer matches and creates a warning.

Fix this by saving a copy of the size on the stack.

Note that the ccm function actually mixes up the inbuf and outbuf
sizes, but it doesn't matter because the two sizes are actually
equal.

Fixes: 1cb328da4e8f ("crypto: tegra - Do not use fixed size buffers")
Reporeted-by: Patrick Talbert <ptalbert@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Vladislav Dronov <vdronov@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
drivers/crypto/tegra/tegra-se-aes.c

index 30c78afe3dea63daaff1871c8e9d9d33358c631e..5086e7f140c303f916a73c230451c0740d7f477a 100644 (file)
@@ -1201,6 +1201,7 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)
        struct crypto_aead *tfm = crypto_aead_reqtfm(req);
        struct tegra_aead_ctx *ctx = crypto_aead_ctx(tfm);
        struct tegra_se *se = ctx->se;
+       unsigned int bufsize;
        int ret;
 
        ret = tegra_ccm_crypt_init(req, se, rctx);
@@ -1210,14 +1211,15 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)
        rctx->key_id = ctx->key_id;
 
        /* Allocate buffers required */
-       rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100;
-       rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size,
+       bufsize = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100;
+       rctx->inbuf.size = bufsize;
+       rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize,
                                             &rctx->inbuf.addr, GFP_KERNEL);
        if (!rctx->inbuf.buf)
                goto out_finalize;
 
-       rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100;
-       rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->outbuf.size,
+       rctx->outbuf.size = bufsize;
+       rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize,
                                              &rctx->outbuf.addr, GFP_KERNEL);
        if (!rctx->outbuf.buf) {
                ret = -ENOMEM;
@@ -1254,11 +1256,11 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq)
        }
 
 out:
-       dma_free_coherent(ctx->se->dev, rctx->inbuf.size,
+       dma_free_coherent(ctx->se->dev, bufsize,
                          rctx->outbuf.buf, rctx->outbuf.addr);
 
 out_free_inbuf:
-       dma_free_coherent(ctx->se->dev, rctx->outbuf.size,
+       dma_free_coherent(ctx->se->dev, bufsize,
                          rctx->inbuf.buf, rctx->inbuf.addr);
 
        if (tegra_key_is_reserved(rctx->key_id))
@@ -1278,6 +1280,7 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)
        struct crypto_aead *tfm = crypto_aead_reqtfm(req);
        struct tegra_aead_ctx *ctx = crypto_aead_ctx(tfm);
        struct tegra_aead_reqctx *rctx = aead_request_ctx(req);
+       unsigned int bufsize;
        int ret;
 
        rctx->src_sg = req->src;
@@ -1296,16 +1299,17 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)
        rctx->key_id = ctx->key_id;
 
        /* Allocate buffers required */
-       rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen;
-       rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size,
+       bufsize = rctx->assoclen + rctx->authsize + rctx->cryptlen;
+       rctx->inbuf.size = bufsize;
+       rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize,
                                             &rctx->inbuf.addr, GFP_KERNEL);
        if (!rctx->inbuf.buf) {
                ret = -ENOMEM;
                goto out_finalize;
        }
 
-       rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen;
-       rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->outbuf.size,
+       rctx->outbuf.size = bufsize;
+       rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize,
                                              &rctx->outbuf.addr, GFP_KERNEL);
        if (!rctx->outbuf.buf) {
                ret = -ENOMEM;
@@ -1342,11 +1346,11 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq)
                ret = tegra_gcm_do_verify(ctx->se, rctx);
 
 out:
-       dma_free_coherent(ctx->se->dev, rctx->outbuf.size,
+       dma_free_coherent(ctx->se->dev, bufsize,
                          rctx->outbuf.buf, rctx->outbuf.addr);
 
 out_free_inbuf:
-       dma_free_coherent(ctx->se->dev, rctx->inbuf.size,
+       dma_free_coherent(ctx->se->dev, bufsize,
                          rctx->inbuf.buf, rctx->inbuf.addr);
 
        if (tegra_key_is_reserved(rctx->key_id))