• Krzysztof Kozlowski's avatar
    crypto: s5p-sss - Close possible race for completed requests · 42d5c176
    Krzysztof Kozlowski authored
    Driver is capable of handling only one request at a time and it stores
    it in its state container struct s5p_aes_dev.  This stored request must be
    protected between concurrent invocations (e.g. completing current
    request and scheduling new one).  Combination of lock and "busy" field
    is used for that purpose.
    
    When "busy" field is true, the driver will not accept new request thus
    it will not overwrite currently handled data.
    
    However commit 28b62b14 ("crypto: s5p-sss - Fix spinlock recursion
    on LRW(AES)") moved some of the write to "busy" field out of a lock
    protected critical section.  This might lead to potential race between
    completing current request and scheduling a new one.  Effectively the
    request completion might try to operate on new crypto request.
    
    Cc: <stable@vger.kernel.org> # v4.10.x
    Fixes: 28b62b14 ("crypto: s5p-sss - Fix spinlock recursion on LRW(AES)")
    Signed-off-by: default avatarKrzysztof Kozlowski <krzk@kernel.org>
    Reviewed-by: default avatarBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    42d5c176
s5p-sss.c 22.5 KB