Re: [PATCH v21 09/14] crypto: qce - Remove unused ignore_buf

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free of DMA resources during device teardown due to incorrect devres ordering.
--

--- Patch [9]: [PATCH v21 09/14] crypto: qce - Remove unused ignore_buf ---
commit 65a70a3ae148fcccff0fe900df224577ddcc1190
Author: Bartosz Golaszewski <brgl@kernel.org>

crypto: qce - Remove unused ignore_buf

This commit removes the unused ignore_buf field from qce_dma_data and
relocates the QCE_IGNORE_BUF_SZ macro since it is only used within a
single compilation unit.

> diff --git a/drivers/crypto/qce/dma.c b/drivers/crypto/qce/dma.c
> index 7ec9d72fd690f..d1daa229361aa 100644
> --- a/drivers/crypto/qce/dma.c
> +++ b/drivers/crypto/qce/dma.c
[ ... ]
> @@ -43,8 +45,6 @@ int devm_qce_dma_request(struct device *dev, struct qce_dma_data *dma)
>  		goto error_nomem;
>  	}
>  
> -	dma->ignore_buf = dma->result_buf + QCE_RESULT_BUF_SZ;
> -
>  	return devm_add_action_or_reset(dev, qce_dma_release, dma);

[Severity: High]
Does this devres registration order create a use-after-free risk for
dma->result_buf and the DMA channels during device unbind?

In drivers/crypto/qce/core.c:qce_crypto_probe(), the devres action to cancel
the background workqueue (qce_cancel_work) is registered before the DMA
resources are requested here.

Because devres executes actions in reverse order, qce_dma_release() will run
before the workqueue is actually canceled.

During device unbind, qce_dma_release() frees the DMA resources:

drivers/crypto/qce/dma.c:qce_dma_release() {
	...
	dma_release_channel(dma->txchan);
	dma_release_channel(dma->rxchan);
	kfree(dma->result_buf);
}

If the workqueue is actively processing requests or starts running before
qce_cancel_work() executes, it will process the next crypto request in the
queue and call qce_skcipher_async_req_handle().

This function will then map the freed result_buf and attempt to use the already
released DMA channels, which can lead to memory corruption or a crash.

>  
>  error_nomem:

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-qcom-qce-cmd-descr-v21-0-bc2583e18475@oss.qualcomm.com?part=9