All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Thorsten Blum <thorsten.blum@linux.dev>,
	Herbert Xu <herbert@gondor.apana.org.au>
Subject: [PATCH 5.10 34/43] crypto: atmel-tdes - use scatterlist length before DMA mapping
Date: Mon, 31 Aug 2026 15:35:42 +0200	[thread overview]
Message-ID: <20260831133400.226641945@linuxfoundation.org> (raw)
In-Reply-To: <20260831133358.571886287@linuxfoundation.org>

5.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thorsten Blum <thorsten.blum@linux.dev>

commit ba199bdaa80b09a7dd92f28751de7f3dbb06c510 upstream.

Using sg_dma_len() is only valid after mapping the scatterlist with
dma_map_sg(). However, atmel_tdes_crypt_start() uses it before mapping
to compare input/output lengths and to compute the transfer count.

Use the original scatterlist lengths before DMA mapping to avoid reading
stale or uninitialized DMA lengths when CONFIG_NEED_SG_DMA_LENGTH=y.

Drop the output scatterlist length in the fast path since it is equal to
->in_sg->length and does not change the transfer count.

Fixes: 13802005d8f2 ("crypto: atmel - add Atmel DES/TDES driver")
Fixes: 1f858040c2f7 ("crypto: atmel-tdes - add support for latest release of the IP (0x700)")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/atmel-tdes.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/drivers/crypto/atmel-tdes.c
+++ b/drivers/crypto/atmel-tdes.c
@@ -509,14 +509,13 @@ static int atmel_tdes_crypt_start(struct
 			IS_ALIGNED(dd->out_sg->length, dd->ctx->block_size);
 		fast = in && out;
 
-		if (sg_dma_len(dd->in_sg) != sg_dma_len(dd->out_sg))
+		if (dd->in_sg->length != dd->out_sg->length)
 			fast = 0;
 	}
 
 
 	if (fast)  {
-		count = min_t(size_t, dd->total, sg_dma_len(dd->in_sg));
-		count = min_t(size_t, count, sg_dma_len(dd->out_sg));
+		count = min_t(size_t, dd->total, dd->in_sg->length);
 
 		err = dma_map_sg(dd->dev, dd->in_sg, 1, DMA_TO_DEVICE);
 		if (!err) {



  parent reply	other threads:[~2026-08-31 14:07 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-31 13:35 [PATCH 5.10 00/43] 5.10.269-rc1 review Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 01/43] RDMA/rxe: Fix OOB in free_rd_atomic_resources() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 02/43] ipv6: mcast: Fix use-after-free when processing MLD queries Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 03/43] ext4: dont enable DAX on new encrypted files Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 04/43] ipvs: reload ip header after head reallocation Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 05/43] io_uring/io-wq: fix worker accounting when canceling creation callbacks Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 06/43] bpf: Remove tst_run from lwt_seg6local_prog_ops Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 07/43] jfs: add check read-only before truncation in jfs_truncate_nolock() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 08/43] jfs: add check read-only before txBeginAnon() call Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 09/43] KVM: arm64: Prevent access to vCPU events before init Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 10/43] bpf: Fix use-after-free in offloaded map/prog info fill Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 11/43] Revert "PM: sleep: Use complete() in device_pm_sleep_init()" Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 12/43] selinux: switch two allocations to use kzalloc_objs() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 13/43] Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 14/43] Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 15/43] ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 16/43] kcov: fix data corruption and race conditions on PREEMPT_RT Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 17/43] ext4: propagate errors from fast commit range replay Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 18/43] nilfs2: reject invalid block index in GC ioctl Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 19/43] nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 20/43] HID: magicmouse: do not keep a stale msc->input if no input is claimed Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 21/43] nfc: nci: add data_len bound checks to activation parameter extractors Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 22/43] nvmet-tcp: bound SGL data length before allocating command buffers Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 23/43] HID: input: read battery capacity from its actual report offset Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 24/43] fpga: dfl: fme: add error handling Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 25/43] accessibility: speakup: unregister tty ldisc on later init failures Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 26/43] usb: usbtest: disable dynamic ID support Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 27/43] usb: gadget: f_tcm: keep port count until LUN teardown completes Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 28/43] xfrm: espintcp: fix UAF during close Greg Kroah-Hartman
2026-09-04  9:51   ` D. Wythe
2026-09-04 12:15     ` Greg Kroah-Hartman
2026-09-05 10:17       ` D. Wythe
2026-09-05 11:16         ` Greg Kroah-Hartman
2026-09-08  0:53         ` Sasha Levin
2026-09-06 13:32     ` Sasha Levin
2026-08-31 13:35 ` [PATCH 5.10 29/43] xfrm: drop ESP-in-TCP packets with no ingress device Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 30/43] xfrm: ah6: validate routing header segments_left Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 31/43] xfrm: fix xfrm_state_construct() auth-trunc leak Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 32/43] ipv6: seg6: clear IPv4 control block on IPIP decapsulation Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 33/43] mm/swap: reject swapon() on filesystem-level encrypted files Greg Kroah-Hartman
2026-08-31 13:35 ` Greg Kroah-Hartman [this message]
2026-08-31 13:35 ` [PATCH 5.10 35/43] crypto: mxs-dcp - fix source scatterlist length access Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 36/43] KVM: s390: vsie: zero stale crypto bits Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 37/43] usb: core: Add lock to usb_wakeup_notification() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 38/43] usb: core: Strengthen error handling in hub_hub_status() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 39/43] ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 40/43] USB: serial: option: fix slab OOB read in interrupt URB callback Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 41/43] USB: serial: spcp8x5: drop broken carrier detect support Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 42/43] USB: c67x00: fix use-after-free in c67x00_add_iso_urb() Greg Kroah-Hartman
2026-08-31 13:35 ` [PATCH 5.10 43/43] usb: usbfs: fix use-after-free of usb_device in usbdev_release() Greg Kroah-Hartman
2026-08-31 17:01 ` [PATCH 5.10 00/43] 5.10.269-rc1 review Florian Fainelli
2026-08-31 19:23 ` Brett A C Sheffield
2026-08-31 20:58 ` Woody Suwalski
2026-09-01  2:00 ` Dominique Martinet
2026-09-01  8:45 ` Pavel Machek
2026-09-01 16:48 ` Shuah Khan
2026-09-02  0:11 ` Barry K. Nathan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260831133400.226641945@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=patches@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    --cc=thorsten.blum@linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.