• Krzysztof Kozlowski's avatar
    crypto: s5p-sss - Fix use after free of copied input buffer in error path · 07c8fccb
    Krzysztof Kozlowski authored
    The driver makes copies of memory (input or output scatterlists) if they
    are not aligned. In s5p_aes_crypt_start() error path (on unsuccessful
    initialization of output scatterlist), if input scatterlist was not
    aligned, the driver first freed copied input memory and then unmapped it
    from the device, instead of doing otherwise (unmap and then free).
    
    This was wrong in two ways:
    1. Freed pages were still mapped to the device.
    2. The dma_unmap_sg() iterated over freed scatterlist structure.
    
    The call to s5p_free_sg_cpy() in this error path is not needed because
    the copied scatterlists will be freed by s5p_aes_complete().
    
    Fixes: 9e4a1100 ("crypto: s5p-sss - Handle unaligned buffers")
    Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    07c8fccb
s5p-sss.c 21.9 KB