From patchwork Wed Feb 28 09:13:16 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Herbert Xu X-Patchwork-Id: 13575097 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 69A1BC54E41 for ; Wed, 28 Feb 2024 09:13:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=h1SBRu3r81vzIN1Pjon6VSu3gKXMTWjnmZz7hEUiHUc=; b=uDYmsX73Cs2jaK MRyYcnUvAPB/6mZWaUhUpkTtFzjneW/LZUGMAhE2rWHdukMncf/mYAnTVrYbuJzJAPgTgnINI1XdI JYZi1ShnE0S5GQNmf70e75OpuO57x2O8JQK5hf05P9oltCIEwZaDZ18hyTyomXPuS+LhPkRajvzaU UVY0qMBGxHHFpa0FG/reITNUqwqDY1ijiqv06PgKyKnHuzZ5DVjyeA5jfZgpeOLul+hgCJBVac7jI 49+Yqjp12EBWS6rDen5N65ViRTotMFPx4+6qgYlNidTNoQTwpjPHrayPxLW1wl4KRO0yTqpmlNQI7 BsCZsDAXAckuSC+kwTDA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rfG04-00000008cyA-3aZL; Wed, 28 Feb 2024 09:13:16 +0000 Received: from abb.hmeau.com ([144.6.53.87]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rfG01-00000008cxh-1Tem for linux-arm-kernel@lists.infradead.org; Wed, 28 Feb 2024 09:13:15 +0000 Received: from loth.rohan.me.apana.org.au ([192.168.167.2]) by formenos.hmeau.com with smtp (Exim 4.94.2 #2 (Debian)) id 1rfFzo-001CIB-TT; Wed, 28 Feb 2024 17:13:02 +0800 Received: by loth.rohan.me.apana.org.au (sSMTP sendmail emulation); Wed, 28 Feb 2024 17:13:16 +0800 Date: Wed, 28 Feb 2024 17:13:16 +0800 From: Herbert Xu To: Andrey Skvortsov Cc: Corentin Labbe , "David S. Miller" , Chen-Yu Tsai , Jernej Skrabec , Samuel Holland , Jonathan Corbet , Ovidiu Panait , linux-crypto@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, Arnaud Ferraris Subject: [PATCH] crypto: rk3288 - Fix use after free in unprepare Message-ID: References: <20240226215358.555234-1-andrej.skvortzov@gmail.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20240226215358.555234-1-andrej.skvortzov@gmail.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240228_011313_411766_986E07C2 X-CRM114-Status: UNSURE ( 7.66 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The unprepare call must be carried out before the finalize call as the latter can free the request. Fixes: c66c17a0f69b ("crypto: rk3288 - Remove prepare/unprepare request") Reported-by: Andrey Skvortsov Cc: Signed-off-by: Herbert Xu Reviewed-by: Andrey Skvortsov diff --git a/drivers/crypto/rockchip/rk3288_crypto_ahash.c b/drivers/crypto/rockchip/rk3288_crypto_ahash.c index 1b13b4aa16ec..a235e6c300f1 100644 --- a/drivers/crypto/rockchip/rk3288_crypto_ahash.c +++ b/drivers/crypto/rockchip/rk3288_crypto_ahash.c @@ -332,12 +332,12 @@ static int rk_hash_run(struct crypto_engine *engine, void *breq) theend: pm_runtime_put_autosuspend(rkc->dev); + rk_hash_unprepare(engine, breq); + local_bh_disable(); crypto_finalize_hash_request(engine, breq, err); local_bh_enable(); - rk_hash_unprepare(engine, breq); - return 0; }