Commit 09dcdbac authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'v6.8-p6' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 

Pull crypto fixes from Herbert Xu:
 "Fix potential use-after-frees in rk3288 and sun8i-ce"

* tag 'v6.8-p6' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: rk3288 - Fix use after free in unprepare
  crypto: sun8i-ce - Fix use after free in unprepare
parents 5847c977 c0afb6b8

drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c

+17 −17
Original line number Diff line number Diff line
@@ -299,22 +299,6 @@ static int sun8i_ce_cipher_prepare(struct crypto_engine *engine, void *async_req 
	return err;

}



static void sun8i_ce_cipher_run(struct crypto_engine *engine, void *areq)

{

	struct skcipher_request *breq = container_of(areq, struct skcipher_request, base);

	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(breq);

	struct sun8i_cipher_tfm_ctx *op = crypto_skcipher_ctx(tfm);

	struct sun8i_ce_dev *ce = op->ce;

	struct sun8i_cipher_req_ctx *rctx = skcipher_request_ctx(breq);

	int flow, err;



	flow = rctx->flow;

	err = sun8i_ce_run_task(ce, flow, crypto_tfm_alg_name(breq->base.tfm));

	local_bh_disable();

	crypto_finalize_skcipher_request(engine, breq, err);

	local_bh_enable();

}



static void sun8i_ce_cipher_unprepare(struct crypto_engine *engine,

				      void *async_req)

{
@@ -360,6 +344,23 @@ static void sun8i_ce_cipher_unprepare(struct crypto_engine *engine, 
	dma_unmap_single(ce->dev, rctx->addr_key, op->keylen, DMA_TO_DEVICE);

}



static void sun8i_ce_cipher_run(struct crypto_engine *engine, void *areq)

{

	struct skcipher_request *breq = container_of(areq, struct skcipher_request, base);

	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(breq);

	struct sun8i_cipher_tfm_ctx *op = crypto_skcipher_ctx(tfm);

	struct sun8i_ce_dev *ce = op->ce;

	struct sun8i_cipher_req_ctx *rctx = skcipher_request_ctx(breq);

	int flow, err;



	flow = rctx->flow;

	err = sun8i_ce_run_task(ce, flow, crypto_tfm_alg_name(breq->base.tfm));

	sun8i_ce_cipher_unprepare(engine, areq);

	local_bh_disable();

	crypto_finalize_skcipher_request(engine, breq, err);

	local_bh_enable();

}



int sun8i_ce_cipher_do_one(struct crypto_engine *engine, void *areq)

{

	int err = sun8i_ce_cipher_prepare(engine, areq);
@@ -368,7 +369,6 @@ int sun8i_ce_cipher_do_one(struct crypto_engine *engine, void *areq) 
		return err;



	sun8i_ce_cipher_run(engine, areq);

	sun8i_ce_cipher_unprepare(engine, areq);

	return 0;

}

drivers/crypto/rockchip/rk3288_crypto_ahash.c

+2 −2
Original line number Diff line number Diff line
@@ -332,12 +332,12 @@ static int rk_hash_run(struct crypto_engine *engine, void *breq) 
theend:

	pm_runtime_put_autosuspend(rkc->dev);



	rk_hash_unprepare(engine, breq);



	local_bh_disable();

	crypto_finalize_hash_request(engine, breq, err);

	local_bh_enable();



	rk_hash_unprepare(engine, breq);



	return 0;

}