iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

This push fixes potential use-after-frees in rk3288 and sun8i-ce.

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmXhr0YACgkQxycdCkmx
 i6fSzA//cuRIg/rP2+0kwiDPgJXvhlfnpFmGpYYeKTD7xa1cVxWf3i5ymhPLj0al
 88vPSfSEyK/FwBTt9zpjtuBWsFivOvyhPrceZOUf72bBRkP1SolMdmBFggud68CJ
 EdyHo4UODFqxuZQAhV611eyK2L2H9Z4nRpNenxTpnqlUJ+LWrLpzjUxS7VlX2LDq
 L2Dlokk86xtvPuIA6Xeh99PcPKaHZGXj1DKdjqFf9genqKJVT9Frq+NRYivBmGtJ
 94akc9pjgb114axkNfs2Zq1slYcVSlUsAZtNZ3SFMrpjVL6DVQmM6Zd5bAtdPW1e
 LX3DX/5WDX21QdvwmTYN+O7DGrXOkaGI1J6TknBITgvY5BL//gf/i5TjNcZqeV45
 RekIFRGaAGs1B58HN0+ZxJD32bA7vpO88Z07vIP2jviXtVh9qFonbigEZUgtFA5l
 2HFrBAkyfS7xUrgbjf9EbAhMfZZrByf5nvctSb6K9lyaJahbzOqp83zZBB5AgMqp
 CkjxTRJM+bzk0u7aUZ7f7a/5gnk48/trfO+4Nfw859O09MKlB/KtyiZagfhLcV22
 sGSKi+tVivEv95dhmXW4DpCF2/6xLFrH9PhmQ4rgsCunqmPC/jSy6u/7xNyAGzQI
 FkKb2u1fbNZjY57HgwAxD40iGSPWQ2CUKJaNbCxkV08raRO0yxg=
 =m0XK
 -----END PGP SIGNATURE-----

Merge tag 'v6.8-p6' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:
 "Fix potential use-after-frees in rk3288 and sun8i-ce"

* tag 'v6.8-p6' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: rk3288 - Fix use after free in unprepare
  crypto: sun8i-ce - Fix use after free in unprepare
This commit is contained in:
Linus Torvalds 2024-03-06 07:56:16 -08:00
commit 09dcdbac54
2 changed files with 19 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
View File

@ -299,22 +299,6 @@ theend:
return err;
}
static void sun8i_ce_cipher_run(struct crypto_engine *engine, void *areq)
{
struct skcipher_request *breq = container_of(areq, struct skcipher_request, base);
struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(breq);
struct sun8i_cipher_tfm_ctx *op = crypto_skcipher_ctx(tfm);
struct sun8i_ce_dev *ce = op->ce;
struct sun8i_cipher_req_ctx *rctx = skcipher_request_ctx(breq);
int flow, err;
flow = rctx->flow;
err = sun8i_ce_run_task(ce, flow, crypto_tfm_alg_name(breq->base.tfm));
local_bh_disable();
crypto_finalize_skcipher_request(engine, breq, err);
local_bh_enable();
}
static void sun8i_ce_cipher_unprepare(struct crypto_engine *engine,
void *async_req)
{
@ -360,6 +344,23 @@ static void sun8i_ce_cipher_unprepare(struct crypto_engine *engine,
dma_unmap_single(ce->dev, rctx->addr_key, op->keylen, DMA_TO_DEVICE);
}
static void sun8i_ce_cipher_run(struct crypto_engine *engine, void *areq)
{
struct skcipher_request *breq = container_of(areq, struct skcipher_request, base);
struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(breq);
struct sun8i_cipher_tfm_ctx *op = crypto_skcipher_ctx(tfm);
struct sun8i_ce_dev *ce = op->ce;
struct sun8i_cipher_req_ctx *rctx = skcipher_request_ctx(breq);
int flow, err;
flow = rctx->flow;
err = sun8i_ce_run_task(ce, flow, crypto_tfm_alg_name(breq->base.tfm));
sun8i_ce_cipher_unprepare(engine, areq);
local_bh_disable();
crypto_finalize_skcipher_request(engine, breq, err);
local_bh_enable();
}
int sun8i_ce_cipher_do_one(struct crypto_engine *engine, void *areq)
{
int err = sun8i_ce_cipher_prepare(engine, areq);
@ -368,7 +369,6 @@ int sun8i_ce_cipher_do_one(struct crypto_engine *engine, void *areq)
return err;
sun8i_ce_cipher_run(engine, areq);
sun8i_ce_cipher_unprepare(engine, areq);
return 0;
}

4
drivers/crypto/rockchip/rk3288_crypto_ahash.c
View File

@ -332,12 +332,12 @@ static int rk_hash_run(struct crypto_engine *engine, void *breq)
theend:
pm_runtime_put_autosuspend(rkc->dev);
rk_hash_unprepare(engine, breq);
local_bh_disable();
crypto_finalize_hash_request(engine, breq, err);
local_bh_enable();
rk_hash_unprepare(engine, breq);
return 0;
}