Re: [PATCH v23 10/14] crypto: qce - Simplify arguments of devm_qce_dma_request()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Device unbind sequence incorrectly releases DMA channels and frees memory before the background work item is cancelled, allowing the work item to trigger a Use-After-Free on these resources.
--

--- Patch [10]: [PATCH v23 10/14] crypto: qce - Simplify arguments of devm_qce_dma_request() ---
commit 6680b197a5f4cdb8f7389167e1c7991cd29ab241
Author: Bartosz Golaszewski <brgl@kernel.org>
Subject: crypto: qce - Simplify arguments of devm_qce_dma_request()

This function can extract all the information it needs from struct
qce_device alone so simplify its arguments. This is done in preparation
for adding support for register I/O over DMA which will require
accessing even more fields from struct qce_device.

> diff --git a/drivers/crypto/qce/core.c b/drivers/crypto/qce/core.c
> index dd860435d2c47..aa4a0b1774908 100644
> --- a/drivers/crypto/qce/core.c
> +++ b/drivers/crypto/qce/core.c
> @@ -237,7 +237,7 @@ static int qce_crypto_probe(struct platform_device *pdev)
>  	if (ret)
>  		return ret;
>  
> -	ret = devm_qce_dma_request(qce->dev, &qce->dma);
> +	ret = devm_qce_dma_request(qce);

[Severity: High]
Does this devres teardown order create a use-after-free during device unbind?

In qce_crypto_probe(), devm_add_action_or_reset() is called for qce_cancel_work
before calling devm_qce_dma_request():

drivers/crypto/qce/core.c:qce_crypto_probe() {
    ...
	INIT_WORK(&qce->done_work, qce_req_done_work);
	ret = devm_add_action_or_reset(dev, qce_cancel_work, &qce->done_work);
	if (ret)
		return ret;
    ...
	ret = devm_qce_dma_request(qce);
    ...
}

Since devres actions execute in reverse order of registration, the DMA resources
freed in qce_dma_release() (which is registered inside devm_qce_dma_request)
will be released before the background work is cancelled.

If the device is unbound while a crypto request is pending, qce_dma_release()
will free the DMA channels and the heap-allocated dma->result_buf.

The background work qce->done_work could then run, dequeue the next request,
and submit it to the freed DMA channels via qce_dma_prep_sgs(), writing to the
freed dma->result_buf.

A later fix in commit "crypto: qce - Cancel work on device detach" resolves
this inverted teardown order by grouping termination and freeing together.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721-qcom-qce-cmd-descr-v23-0-1be02deffda9@oss.qualcomm.com?part=10