Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 24fbf7ba authored by Yunfeng Ye's avatar Yunfeng Ye Committed by Herbert Xu
Browse files

crypto: hisilicon - Fix double free in sec_free_hw_sgl() 



There are two problems in sec_free_hw_sgl():

First, when sgl_current->next is valid, @hw_sgl will be freed in the
first loop, but it free again after the loop.

Second, sgl_current and sgl_current->next_sgl is not match when
dma_pool_free() is invoked, the third parameter should be the dma
address of sgl_current, but sgl_current->next_sgl is the dma address
of next chain, so use sgl_current->next_sgl is wrong.

Fix this by deleting the last dma_pool_free() in sec_free_hw_sgl(),
modifying the condition for while loop, and matching the address for
dma_pool_free().

Fixes: 915e4e84 ("crypto: hisilicon - SEC security accelerator driver")
Signed-off-by: default avatarYunfeng Ye <yeyunfeng@huawei.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 212ef6f2

drivers/crypto/hisilicon/sec/sec_algs.c

+7 −6
Original line number Diff line number Diff line
@@ -215,17 +215,18 @@ static void sec_free_hw_sgl(struct sec_hw_sgl *hw_sgl, 
			    dma_addr_t psec_sgl, struct sec_dev_info *info)

{

	struct sec_hw_sgl *sgl_current, *sgl_next;

	dma_addr_t sgl_next_dma;



	if (!hw_sgl)

		return;

	sgl_current = hw_sgl;

	while (sgl_current->next) {

	while (sgl_current) {

		sgl_next = sgl_current->next;

		dma_pool_free(info->hw_sgl_pool, sgl_current,

			      sgl_current->next_sgl);

		sgl_next_dma = sgl_current->next_sgl;



		dma_pool_free(info->hw_sgl_pool, sgl_current, psec_sgl);



		sgl_current = sgl_next;

		psec_sgl = sgl_next_dma;

	}

	dma_pool_free(info->hw_sgl_pool, hw_sgl, psec_sgl);

}



static int sec_alg_skcipher_setkey(struct crypto_skcipher *tfm,