All of lore.kernel.org
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: ZhaoJinming <zhaojinming@uniontech.com>,
	"Bartosz Golaszewski" <brgl@kernel.org>,
	"Herbert Xu" <herbert@gondor.apana.org.au>,
	"David S. Miller" <davem@davemloft.net>,
	"Thara Gopinath" <thara.gopinath@linaro.org>
Cc: linux-crypto@vger.kernel.org,
	"Eric Biggers" <ebiggers@kernel.org>,
	"Bartosz Golaszewski" <bartosz.golaszewski@oss.qualcomm.com>
Subject: Re: [PATCH v2 2/7] crypto: qce - fix memory leak of the CCM AAD buffer
Date: Fri, 13 Nov 2026 07:06:44 +0000	[thread overview]
Message-ID: <sashiko-outbox-212317@kernel.org> (raw)
In-Reply-To: <20261113-fix-qce-ccm-adata-leak-v2-2-914501377a62@uniontech.com>

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] crypto: qce: single-word name in Signed-off-by trailer
--

commit 8b5fc4cf5bc1b9c0817753d0bd63aca7091e3300
Author: ZhaoJinming <zhaojinming@uniontech.com>

> crypto: qce - fix memory leak of the CCM AAD buffer
>
> qce_aead_ccm_prepare_buf_assoclen() allocates rctx->adata with kzalloc()
> for every CCM request that carries associated data, but the buffer is
> never freed: qce_aead_done() releases only the scatterlist tables, and
> none of the error paths release it either.  Every such request therefore
> leaks a small allocation.
>
> Free rctx->adata in the completion handler and on all error paths: the
> sg_copy_to_buffer() and sg_alloc_table() failures in
> qce_aead_ccm_prepare_buf_assoclen() (through the new err_free_adata
> label) and the error cleanup of qce_aead_async_req_handle().
>
> The buffer is referenced by a scatterlist that is DMA-mapped, so it is
> freed only after dma_unmap_sg() has run.  The frees are guarded the same
> way as the surrounding sg_free_table() calls, so no path frees the
> buffer twice or frees a stale pointer.
>
> Fixes: 9363efb4181c ("crypto: qce - Add support for AEAD algorithms")
> Reported-by: Eric Biggers <ebiggers@kernel.org>
> Link: https://lore.kernel.org/linux-crypto/20260723183438.GB93534@quark/
> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>

[Severity: High]
Should the Author and Signed-off-by lines separate the given name and
family name with a space (e.g., "Zhao Jinming" or "Jinming Zhao") instead
of using the single word "ZhaoJinming", as required by the Developer's
Certificate of Origin in Documentation/process/submitting-patches.rst?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113-fix-qce-ccm-adata-leak-v2-0-914501377a62@uniontech.com?part=2

  reply	other threads:[~2026-11-13  7:06 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-13  6:54 [PATCH v2 0/7] crypto: qce - fix CCM AAD buffer leak and AEAD error-path bugs ZhaoJinming
2026-11-13  6:54 ` [PATCH v2 1/7] crypto: qce - unmap the correct scatterlist in the CCM error path ZhaoJinming
2026-11-13  6:54 ` [PATCH v2 2/7] crypto: qce - fix memory leak of the CCM AAD buffer ZhaoJinming
2026-11-13  7:06   ` sashiko-bot [this message]
2026-11-13  6:54 ` [PATCH v2 3/7] crypto: qce - check dma_map_sg() result for the source scatterlist ZhaoJinming
2026-11-13  6:54 ` [PATCH v2 4/7] crypto: qce - do not free an uninitialized dst_tbl on the error path ZhaoJinming
2026-11-13  6:54 ` [PATCH v2 5/7] crypto: qce - terminate the DMA channels if descriptor preparation fails ZhaoJinming
2026-11-13  6:54 ` [PATCH v2 6/7] crypto: qce - reject a negative scatterlist count in CCM AAD preparation ZhaoJinming
2026-11-13  7:08   ` sashiko-bot
2026-11-13  6:54 ` [PATCH v2 7/7] crypto: qce - release dst_tbl when the source scatterlist is invalid ZhaoJinming

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=sashiko-outbox-212317@kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=bartosz.golaszewski@oss.qualcomm.com \
    --cc=brgl@kernel.org \
    --cc=davem@davemloft.net \
    --cc=ebiggers@kernel.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=linux-crypto@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    --cc=thara.gopinath@linaro.org \
    --cc=zhaojinming@uniontech.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.