Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 396bf4cd authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 

Pull crypto fixes from Herbert Xu:

 - use-after-free in algif_aead

 - modular aesni regression when pcbc is modular but absent

 - bug causing IO page faults in ccp

 - double list add in ccp

 - NULL pointer dereference in qat (two patches)

 - panic in chcr

 - NULL pointer dereference in chcr

 - out-of-bound access in chcr

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: chcr - Fix key length for RFC4106
  crypto: algif_aead - Fix kernel panic on list_del
  crypto: aesni - Fix failure when pcbc module is absent
  crypto: ccp - Fix double add when creating new DMA command
  crypto: ccp - Fix DMA operations when IOMMU is enabled
  crypto: chcr - Check device is allocated before use
  crypto: chcr - Fix panic on dma_unmap_sg
  crypto: qat - zero esram only for DH85x devices
  crypto: qat - fix bar discovery for c62x
parents d5adbfcd 7c2cf1c4

arch/x86/crypto/aesni-intel_glue.c

+4 −4
Original line number Diff line number Diff line
@@ -1085,8 +1085,8 @@ static void aesni_free_simds(void) 
		    aesni_simd_skciphers[i]; i++)

		simd_skcipher_free(aesni_simd_skciphers[i]);



	for (i = 0; i < ARRAY_SIZE(aesni_simd_skciphers2) &&

		    aesni_simd_skciphers2[i].simd; i++)

	for (i = 0; i < ARRAY_SIZE(aesni_simd_skciphers2); i++)

		if (aesni_simd_skciphers2[i].simd)

			simd_skcipher_free(aesni_simd_skciphers2[i].simd);

}
@@ -1168,7 +1168,7 @@ static int __init aesni_init(void) 
		simd = simd_skcipher_create_compat(algname, drvname, basename);

		err = PTR_ERR(simd);

		if (IS_ERR(simd))

			goto unregister_simds;

			continue;



		aesni_simd_skciphers2[i].simd = simd;

	}

crypto/algif_aead.c

+1 −1
Original line number Diff line number Diff line
@@ -661,9 +661,9 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags) 
unlock:

	list_for_each_entry_safe(rsgl, tmp, &ctx->list, list) {

		af_alg_free_sg(&rsgl->sgl);

		list_del(&rsgl->list);

		if (rsgl != &ctx->first_rsgl)

			sock_kfree_s(sk, rsgl, sizeof(*rsgl));

		list_del(&rsgl->list);

	}

	INIT_LIST_HEAD(&ctx->list);

	aead_wmem_wakeup(sk);

drivers/crypto/ccp/ccp-dev-v5.c

+1 −1
Original line number Diff line number Diff line
@@ -959,7 +959,7 @@ static irqreturn_t ccp5_irq_handler(int irq, void *data) 
static void ccp5_config(struct ccp_device *ccp)

{

	/* Public side */

	iowrite32(0x00001249, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);

	iowrite32(0x0, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);

}



static void ccp5other_config(struct ccp_device *ccp)

drivers/crypto/ccp/ccp-dev.h

+1 −0
Original line number Diff line number Diff line
@@ -238,6 +238,7 @@ struct ccp_dma_chan { 
	struct ccp_device *ccp;



	spinlock_t lock;

	struct list_head created;

	struct list_head pending;

	struct list_head active;

	struct list_head complete;

drivers/crypto/ccp/ccp-dmaengine.c

+5 −1
Original line number Diff line number Diff line
@@ -63,6 +63,7 @@ static void ccp_free_chan_resources(struct dma_chan *dma_chan) 
	ccp_free_desc_resources(chan->ccp, &chan->complete);

	ccp_free_desc_resources(chan->ccp, &chan->active);

	ccp_free_desc_resources(chan->ccp, &chan->pending);

	ccp_free_desc_resources(chan->ccp, &chan->created);



	spin_unlock_irqrestore(&chan->lock, flags);

}
@@ -273,6 +274,7 @@ static dma_cookie_t ccp_tx_submit(struct dma_async_tx_descriptor *tx_desc) 
	spin_lock_irqsave(&chan->lock, flags);



	cookie = dma_cookie_assign(tx_desc);

	list_del(&desc->entry);

	list_add_tail(&desc->entry, &chan->pending);



	spin_unlock_irqrestore(&chan->lock, flags);
@@ -426,7 +428,7 @@ static struct ccp_dma_desc *ccp_create_desc(struct dma_chan *dma_chan, 


	spin_lock_irqsave(&chan->lock, sflags);



	list_add_tail(&desc->entry, &chan->pending);

	list_add_tail(&desc->entry, &chan->created);



	spin_unlock_irqrestore(&chan->lock, sflags);
@@ -610,6 +612,7 @@ static int ccp_terminate_all(struct dma_chan *dma_chan) 
	/*TODO: Purge the complete list? */

	ccp_free_desc_resources(chan->ccp, &chan->active);

	ccp_free_desc_resources(chan->ccp, &chan->pending);

	ccp_free_desc_resources(chan->ccp, &chan->created);



	spin_unlock_irqrestore(&chan->lock, flags);
@@ -679,6 +682,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp) 
		chan->ccp = ccp;



		spin_lock_init(&chan->lock);

		INIT_LIST_HEAD(&chan->created);

		INIT_LIST_HEAD(&chan->pending);

		INIT_LIST_HEAD(&chan->active);

		INIT_LIST_HEAD(&chan->complete);