From patchwork Tue Apr 19 13:44:11 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krzysztof Kozlowski X-Patchwork-Id: 8880221 X-Patchwork-Delegate: herbert@gondor.apana.org.au Return-Path: X-Original-To: patchwork-linux-crypto@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 0972ABF29F for ; Tue, 19 Apr 2016 13:44:35 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 02FBB202BE for ; Tue, 19 Apr 2016 13:44:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CF31C20270 for ; Tue, 19 Apr 2016 13:44:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752854AbcDSNob (ORCPT ); Tue, 19 Apr 2016 09:44:31 -0400 Received: from mailout2.w1.samsung.com ([210.118.77.12]:21054 "EHLO mailout2.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752545AbcDSNoa (ORCPT ); Tue, 19 Apr 2016 09:44:30 -0400 Received: from eucpsbgm1.samsung.com (unknown [203.254.199.244]) by mailout2.w1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTP id <0O5V00G0UVI25O10@mailout2.w1.samsung.com>; Tue, 19 Apr 2016 14:44:26 +0100 (BST) X-AuditID: cbfec7f4-f796c6d000001486-7e-5716363a7b21 Received: from eusync2.samsung.com ( [203.254.199.212]) by eucpsbgm1.samsung.com (EUCPMTA) with SMTP id ED.F1.05254.A3636175; Tue, 19 Apr 2016 14:44:26 +0100 (BST) Received: from AMDC2174.DIGITAL.local ([106.120.53.17]) by eusync2.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0O5V001QHVHZAG30@eusync2.samsung.com>; Tue, 19 Apr 2016 14:44:26 +0100 (BST) From: Krzysztof Kozlowski To: Herbert Xu , "David S. Miller" , Krzysztof Kozlowski , Vladimir Zapolskiy , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org Cc: Bartlomiej Zolnierkiewicz Subject: [PATCH 1/2] crypto: s5p-sss - Fix use after free of copied input buffer in error path Date: Tue, 19 Apr 2016 15:44:11 +0200 Message-id: <1461073452-10426-1-git-send-email-k.kozlowski@samsung.com> X-Mailer: git-send-email 1.9.1 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrLJMWRmVeSWpSXmKPExsVy+t/xK7pWZmLhBjf+a1psnLGe1WLO+RYW i/lHzrFadL+SsXj9wtDi/r2fTBaXd81hs/j/q5nZgcNjy8qbTB7bDqh6/Fs4hcWjb8sqRo/P m+QCWKO4bFJSczLLUov07RK4Mi5v7mMuuMNZcW6idwPjJI4uRk4OCQETiR/rrzNC2GISF+6t ZwOxhQSWMkrceeLRxcgFZDcySUxrXMwEkmATMJbYvHwJG0hCRKCdSWJF2zVmkASzgIXE1q2r 2UFsYYEEieb+TWCTWARUJY5suwFm8wq4S+w6tIsFYpucxMljk1knMHIvYGRYxSiaWppcUJyU nmuoV5yYW1yal66XnJ+7iRESKF92MC4+ZnWIUYCDUYmHN6BANFyINbGsuDL3EKMEB7OSCK+D sVi4EG9KYmVValF+fFFpTmrxIUZpDhYlcd65u96HCAmkJ5akZqemFqQWwWSZODilGhjr/7y8 m1/5rc+iTC6X8dVhli1eOyJ3Fmxde2/rgYesy2JCc2wl1rdmOiQ/NCh2EVx40+Zj+aITfCfY 3J7ysIRY7eI3uCxy5Hng03WMjDNY+dWvzTmUEWMSX7XvFce5jGVr183Yosp6+vyqmZO2Xzod pzd/vpNB7G0Fe478Wb+zp/N5CHmsYbmgxFKckWioxVxUnAgAHivKzRACAAA= Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org X-Spam-Status: No, score=-7.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The driver makes copies of memory (input or output scatterlists) if they are not aligned. In s5p_aes_crypt_start() error path (on unsuccessful initialization of output scatterlist), if input scatterlist was not aligned, the driver first freed copied input memory and then unmapped it from the device, instead of doing otherwise (unmap and then free). This was wrong in two ways: 1. Freed pages were still mapped to the device. 2. The dma_unmap_sg() iterated over freed scatterlist structure. The call to s5p_free_sg_cpy() in this error path is not needed because the copied scatterlists will be freed by s5p_aes_complete(). Fixes: 9e4a1100a445 ("crypto: s5p-sss - Handle unaligned buffers") Signed-off-by: Krzysztof Kozlowski Acked-by: Vladimir Zapolskiy --- drivers/crypto/s5p-sss.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c index 4f6d5b3ec418..b0484d4d68d9 100644 --- a/drivers/crypto/s5p-sss.c +++ b/drivers/crypto/s5p-sss.c @@ -577,7 +577,6 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode) return; outdata_error: - s5p_free_sg_cpy(dev, &dev->sg_src_cpy); s5p_unset_indata(dev); indata_error: