From patchwork Sun Oct 18 16:51:36 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Russell King X-Patchwork-Id: 7431081 X-Patchwork-Delegate: herbert@gondor.apana.org.au Return-Path: X-Original-To: patchwork-linux-crypto@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id BBC449F36A for ; Sun, 18 Oct 2015 16:51:47 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id CA4F92061E for ; Sun, 18 Oct 2015 16:51:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C5DE820608 for ; Sun, 18 Oct 2015 16:51:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932125AbbJRQvp (ORCPT ); Sun, 18 Oct 2015 12:51:45 -0400 Received: from pandora.arm.linux.org.uk ([78.32.30.218]:45376 "EHLO pandora.arm.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932081AbbJRQvo (ORCPT ); Sun, 18 Oct 2015 12:51:44 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=arm.linux.org.uk; s=pandora-2014; h=Date:Sender:Message-Id:Content-Type:Content-Transfer-Encoding:MIME-Version:Subject:Cc:To:From:References:In-Reply-To; bh=fqEarFOoZyOWQ2Vs1WeILKftH+P1XqauU3QusxK2Vqw=; b=YXf2C3EpT2rUhxzcEZy21y2sThGSTSJMn7jR/apquwvHeL1LIjbWCC4bxPjtFGOblUYe0mm8kXLiYzu48EPTS68vF0x4Y6Dk2S1JSil0qb+vxS+kwx4Koi3cZs2WB7mf050Hw/9bewTXrsU64q2n5sfozstn4WBcosnax/lEv4k=; Received: from e0022681537dd.dyn.arm.linux.org.uk ([2002:4e20:1eda:1:222:68ff:fe15:37dd]:55627 helo=rmk-PC.arm.linux.org.uk) by pandora.arm.linux.org.uk with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1ZnrBJ-0002up-Ec; Sun, 18 Oct 2015 17:51:37 +0100 Received: from rmk by rmk-PC.arm.linux.org.uk with local (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1ZnrBI-0005nl-65; Sun, 18 Oct 2015 17:51:36 +0100 In-Reply-To: <20151018165046.GA7997@n2100.arm.linux.org.uk> References: <20151018165046.GA7997@n2100.arm.linux.org.uk> From: Russell King To: Victoria Milhoan , horia.geanta@freescale.com, fabio.estevam@freescale.com Cc: Herbert Xu , "David S. Miller" , linux-crypto@vger.kernel.org Subject: [PATCH 6/6] crypto: caam: fix DMA API leak MIME-Version: 1.0 Content-Disposition: inline Message-Id: Date: Sun, 18 Oct 2015 17:51:36 +0100 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID,T_RP_MATCHES_RCVD,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP caamhash contains this weird code: src_nents = sg_count(req->src, req->nbytes, &chained); dma_map_sg_chained(jrdev, req->src, src_nents ? : 1, DMA_TO_DEVICE, chained); ... edesc->src_nents = src_nents; sg_count() returns zero when __sg_count() returns zero or one. This is used to mean that we don't need to use a hardware scatterlist. However, setting src_nents to zero causes problems when we unmap: if (edesc->src_nents) dma_unmap_sg_chained(dev, req->src, edesc->src_nents, DMA_TO_DEVICE, edesc->chained); as zero here means that we have no entries to unmap. This can be fixed in two ways: either by writing the number of entries that were requested of dma_map_sg_chained(), or by reworking the "no SG required" case. We adopt the re-work solution here - we replace sg_count() with __sg_count(), so src_nents now contains the real number of scatterlist entries, and we then change the test for using the hardware scatterlist to src_nents > 1 rather than just non-zero. This change passes my sshd, openssl tests hashing /bin and tcrypt tests. Signed-off-by: Russell King --- drivers/crypto/caam/caamhash.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c index f30c93840bba..28434ad08cb4 100644 --- a/drivers/crypto/caam/caamhash.c +++ b/drivers/crypto/caam/caamhash.c @@ -1095,10 +1095,13 @@ static int ahash_digest(struct ahash_request *req) u32 options; int sh_len; - src_nents = sg_count(req->src, req->nbytes, &chained); - dma_map_sg_chained(jrdev, req->src, src_nents ? : 1, DMA_TO_DEVICE, + src_nents = __sg_count(req->src, req->nbytes, &chained); + dma_map_sg_chained(jrdev, req->src, src_nents, DMA_TO_DEVICE, chained); - sec4_sg_bytes = src_nents * sizeof(struct sec4_sg_entry); + if (src_nents > 1) + sec4_sg_bytes = src_nents * sizeof(struct sec4_sg_entry); + else + sec4_sg_bytes = 0; /* allocate space for base edesc and hw desc commands, link tables */ edesc = kzalloc(sizeof(*edesc) + sec4_sg_bytes + DESC_JOB_IO_LEN, @@ -1117,7 +1120,7 @@ static int ahash_digest(struct ahash_request *req) desc = edesc->hw_desc; init_job_desc_shared(desc, ptr, sh_len, HDR_SHARE_DEFER | HDR_REVERSE); - if (src_nents) { + if (src_nents > 1) { sg_to_sec4_sg_last(req->src, src_nents, edesc->sec4_sg, 0); edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg, sec4_sg_bytes, DMA_TO_DEVICE); @@ -1447,11 +1450,15 @@ static int ahash_update_first(struct ahash_request *req) to_hash = req->nbytes - *next_buflen; if (to_hash) { - src_nents = sg_count(req->src, req->nbytes - (*next_buflen), - &chained); - dma_map_sg_chained(jrdev, req->src, src_nents ? : 1, + src_nents = __sg_count(req->src, req->nbytes - (*next_buflen), + &chained); + dma_map_sg_chained(jrdev, req->src, src_nents, DMA_TO_DEVICE, chained); - sec4_sg_bytes = src_nents * sizeof(struct sec4_sg_entry); + if (src_nents > 1) + sec4_sg_bytes = src_nents * + sizeof(struct sec4_sg_entry); + else + sec4_sg_bytes = 0; /* * allocate space for base edesc and hw desc commands, @@ -1472,7 +1479,7 @@ static int ahash_update_first(struct ahash_request *req) DESC_JOB_IO_LEN; edesc->dst_dma = 0; - if (src_nents) { + if (src_nents > 1) { sg_to_sec4_sg_last(req->src, src_nents, edesc->sec4_sg, 0); edesc->sec4_sg_dma = dma_map_single(jrdev,