From nobody Mon Sep 28 11:40:13 2026 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E2BE3905EC for ; Sat, 22 Aug 2026 08:45:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787388329; cv=none; b=Ayj/bZheJr1X+Os8p6EqAFQ/FIFuGu4YBYMTEGlbMk68RmnK6MAMwy0LiuuCaHfUyOG0ZvlbKLNUCD86PlfdHi3lKJJCH2BbbQhVUtW4AELviA01HAF/RO+lOPNuvznoM0j3Hj5E5GmVU62al3j9GXWyxo7pOUWGyqIaO1EqQ9A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787388329; c=relaxed/simple; bh=LgJkC43UU3SzSb36mlfID1pfqacnkEZzBSfIu4rC31s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ENfQZeNPwjg5odWmaXj+6XF4G7+mBfiHZLxuCdbUSyFYl6Lmm9xjEJ5ePH2IxcSEpkcSPG0sdbYDmHVPCU7hh4GGzABYfZ5y8o5O46peI9SgxRpLfih1CpvIle4VGbd8hCaocxeI5IGprl7op92UWL91+P88+LCg6HhJXX9m/Rw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=s6G0g6zW; arc=none smtp.client-ip=209.85.216.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="s6G0g6zW" Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-38dfe910e9dso2013527a91.3 for ; Sat, 22 Aug 2026 01:45:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787388317; x=1787993117; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=74796tnDJ+NCSB9SFK75OzCa7nSnHKFX91lyqQmVcl4=; b=s6G0g6zWw+apEkNtqjMobA2qTbrVxYYeF9LLSPPPXbpT/rvgRTVcxDZkMcvajQ/SQv PGPh1sYbK+qww7gDT0BPuSbGCI120yagdMik4/JwWd2O04WaZGziHY21p8V60+MsWgge u7tdZmUDdvG8sct45n/N3ZWBHPLwq42Md7AIozTLLRSetCmzMOztkNWPUb/BAhu+M/id iySj3ndnjTY96h4D8wwZ6tDme3SHolDolAz2cWY8ZTXdYQ3ULnuh7j84FqZfg2fcnOYj EHlIf7P1ZoOLWpyijZ7zlKUjIPr1swv/xt39yvgzYhGUPW6fOJWGjTXxqj7KPNCJTl7N yNIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787388317; x=1787993117; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=74796tnDJ+NCSB9SFK75OzCa7nSnHKFX91lyqQmVcl4=; b=ogg08hrZKVqk70JgNcUwDdilMdYmFjfF8YPkf7zdo0tMzgdDnOiihB6kIVdi7Lmij3 aM5iPtO4JUsJWYW5ssCc0lHj7h+g+3ZR1yvvcuPIK1jH65whsjhZyFskpz0Wt+Q5oVsh 6pGjrEb7yLFCVDRwjLI1oUtxr1zpsO5oE52zeCNkGeQ32EbOLu46QqYtMwyNVFqE99bB a56zVYexBv9AdI0QMHZS+k/uhynLttnzm/Ts5irm1GzKQKYXPK7ixG8lOPvohfio37gh GJg6cmXk9jTClSatc+wtn0iFgZgNr0usbcej98M7z5Rf/UUys9Bd7r/Ze6aoYaNtBWVS 5O2A== X-Forwarded-Encrypted: i=1; AHgh+RoKh04Q6cNcGxN2Xm+TMain55/gUJOyfuboeO8JM+zQm948t5daZ1eRfPvG3rpkLDpaJEZJRFlPvs6zf0o=@vger.kernel.org X-Gm-Message-State: AFuF++mGVsm69HHnLqk7NvKJsKn3Mg4A4vFR9CP++/yOJSIeSYvG2wC6 U3lbDkklQ5Xmw+yAZaaxZjY26sXCCVHtemhCt7OTXa3KDeBAYTG0RkUw X-Gm-Gg: AR+sD1342K+IsOZxRRRxHGQtxTxLeql2yZ0Tsx+BHNqHCfNWu8cuXDdAvxNrQgfcZyw V8Q+hHTaHPsQL+VENFUxck2asweLSf9XvE2RIAs46B0SSP8kJt57CLDdCZK51ZIoh5HT7nY4WxF w4xZN2lGdXhcPM4diZgK1PYMSRazI8O1DowuL+CvmaQ4qoErlFoA340a2JLC3bfriVa+uq408kl +GF/U3LOB8RWCBx05OI4kZN9wpDl2H1mLTUs8mrsiKNaOhn1u/eANWmU6cQsw5enxTkf0LZ7Fqj bQeHbFdl4AMjvmuK8lDF830i7sA6/A/dbHA34+Us40mUuVO2jPdbNozZdYemTTBeMPDLtQOlIs6 iclIRq516Yx+wNa9Z9PauJvUJrnUpxuDZtE20mIAbbtTdI+uCFhMyvQtDBr7qJHYg3PM68Kp8h+ IZgeh3o7zMAHwK3sE8r3COTIos0gCTBQ2q2Jn2aqoakj7ujFWQ+KS3ndbEbDZDdhkFoiHPUhiPa g9gn0j+ X-Received: by 2002:a17:90a:ec8e:b0:38e:c7b0:84ad with SMTP id 98e67ed59e1d1-395c2f2a10bmr22322171a91.0.1787388317445; Sat, 22 Aug 2026 01:45:17 -0700 (PDT) Received: from kernel ([103.219.206.63]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327f909c6c9sm5467855eec.6.2026.08.22.01.45.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Aug 2026 01:45:16 -0700 (PDT) From: Mohamad Raizudeen To: clabbe@baylibre.com, herbert@gondor.apana.org.au, davem@davemloft.net Cc: skhan@linuxfoundation.org, me@brighamcampbell.com, jkoolstra@xs4all.nl, linux-crypto@vger.kernel.org, linux-amlogic@lists.infradead.org, linux-kernel@vger.kernel.org, Mohamad Raizudeen Subject: [PATCH v2] crypto: amlogic: Fix DMA memory leak in cipher error path Date: Sat, 22 Aug 2026 14:15:08 +0530 Message-ID: <20260822084509.26385-1-raizudeen.kerneldev@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" A DMA memory leak occurs in meson_cipher() on the mapping error paths. The driver jumps to the end of the function without unmapping the previously mapped source scatterlist and key/IV buffer when the destination apping fails. Additionally, a memory leak occurs when a scatterlist mapping succeeds but the returned count exceeds the driver's MAXDESC limit. In this case, the driver rejects the mapping without unmapping it. The BIDIRECTIONAL mapping branch also lacks the required 'MAXDESC -3' upper bound check. Fix this by introducing proper error labels, error_src and error_keyiv and unmap resources immediately inside the calidation checks to ensure all successfully mapped resources are cleaned up before returning the error. Fixes: 48fe583fe541 ("crypto: amlogic - Add crypto accelerator for amlogic = GXL") Signed-off-by: Mohamad Raizudeen --- Changes in v2: - Add missing '> MAXDESC - 3' upper bound check for the BIDIRECTIONAL scatterlist mapping branch. - Unmap scatterlists immediately inside the 'if' block when the count exceeds MAXDESC - 3, because dma_map_sg() actually succeeds in this case and the mapping must be undone. drivers/crypto/amlogic/amlogic-gxl-cipher.c | 25 ++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/drivers/crypto/amlogic/amlogic-gxl-cipher.c b/drivers/crypto/a= mlogic/amlogic-gxl-cipher.c index 29048da6f50a..39b44ec89997 100644 --- a/drivers/crypto/amlogic/amlogic-gxl-cipher.c +++ b/drivers/crypto/amlogic/amlogic-gxl-cipher.c @@ -177,10 +177,13 @@ static int meson_cipher(struct skcipher_request *areq) if (areq->src =3D=3D areq->dst) { nr_sgs =3D dma_map_sg(mc->dev, areq->src, sg_nents(areq->src), DMA_BIDIRECTIONAL); - if (!nr_sgs) { - dev_err(mc->dev, "Invalid SG count %d\n", nr_sgs); + if (!nr_sgs || nr_sgs > MAXDESC - 3) { + dev_err(mc->dev, "Invalid BIDIR SG count %d\n", nr_sgs); err =3D -EINVAL; - goto theend; + =09 + if (nr_sgs) + dma_unmap_sg(mc->dev, areq->src, sg_nents(areq->src), DMA_BIDIRECTIONA= L); + goto error_keyiv; } nr_sgd =3D nr_sgs; } else { @@ -189,14 +192,20 @@ static int meson_cipher(struct skcipher_request *areq) if (!nr_sgs || nr_sgs > MAXDESC - 3) { dev_err(mc->dev, "Invalid SG count %d\n", nr_sgs); err =3D -EINVAL; - goto theend; + + if (nr_sgs) + dma_unmap_sg(mc->dev, areq->src, sg_nents(areq->src), DMA_TO_DEVICE); + goto error_keyiv; } nr_sgd =3D dma_map_sg(mc->dev, areq->dst, sg_nents(areq->dst), DMA_FROM_DEVICE); if (!nr_sgd || nr_sgd > MAXDESC - 3) { dev_err(mc->dev, "Invalid SG count %d\n", nr_sgd); err =3D -EINVAL; - goto theend; + + if (nr_sgd) + dma_unmap_sg(mc->dev, areq->dst, sg_nents(areq->dst), DMA_FROM_DEVICE); + goto error_src; } } =20 @@ -251,6 +260,12 @@ static int meson_cipher(struct skcipher_request *areq) ivsize, 0); } } + goto theend; + +error_src: + dma_unmap_sg(mc->dev, areq->src, sg_nents(areq->src), DMA_TO_DEVICE); +error_keyiv: + dma_unmap_single(mc->dev, phykeyiv, keyivlen, DMA_TO_DEVICE); theend: kfree_sensitive(bkeyiv); kfree_sensitive(backup_iv); --=20 2.53.0