* [PATCH] crypto: sa2ul: Add error handling for DMA metadata retrieval
@ 2025-11-13 7:51 Haotian Zhang
2025-11-13 18:54 ` kernel test robot
2025-11-13 22:13 ` kernel test robot
0 siblings, 2 replies; 3+ messages in thread
From: Haotian Zhang @ 2025-11-13 7:51 UTC (permalink / raw)
To: herbert, davem; +Cc: linux-crypto, linux-kernel, Haotian Zhang
The SA2UL driver calls dmaengine_desc_get_metadata_ptr() in AES, SHA and
AEAD DMA paths without checking for error pointers. If the metadata
retrieval fails, these functions may dereference an ERR_PTR value,
leading to kernel crashes or undefined behavior.
Add proper IS_ERR() checks after each dmaengine_desc_get_metadata_ptr()
call, log the failure, clean up the DMA state, and complete the crypto
request with an error.
Fixes: 7694b6ca649f ("crypto: sa2ul - Add crypto driver")
Fixes: 2dc53d004745 ("crypto: sa2ul - add sha1/sha256/sha512 support")
Fixes: d2c8ac187fc9 ("crypto: sa2ul - Add AEAD algorithm support")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
drivers/crypto/sa2ul.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
index fdc0b2486069..eaec284b5e4b 100644
--- a/drivers/crypto/sa2ul.c
+++ b/drivers/crypto/sa2ul.c
@@ -1051,6 +1051,13 @@ static void sa_aes_dma_in_callback(void *data)
if (req->iv) {
mdptr = (__be32 *)dmaengine_desc_get_metadata_ptr(rxd->tx_in, &pl,
&ml);
+ if (IS_ERR(mdptr)) {
+ dev_err(rxd->ddev, "Failed to get AES RX metadata pointer: %ld\n",
+ PTR_ERR(mdptr));
+ sa_free_sa_rx_data(rxd);
+ skcipher_request_complete(req, PTR_ERR(mdptr));
+ return;
+ }
result = (u32 *)req->iv;
for (i = 0; i < (rxd->enc_iv_size / 4); i++)
@@ -1272,6 +1279,12 @@ static int sa_run(struct sa_req *req)
* crypto algorithm to be used, data sizes, different keys etc.
*/
mdptr = (u32 *)dmaengine_desc_get_metadata_ptr(tx_out, &pl, &ml);
+ if (IS_ERR(mdptr)) {
+ dev_err(pdata->dev, "Failed to get TX metadata pointer: %ld\n",
+ PTR_ERR(mdptr));
+ ret = PTR_ERR(mdptr);
+ goto err_cleanup;
+ }
sa_prepare_tx_desc(mdptr, (sa_ctx->cmdl_size + (SA_PSDATA_CTX_WORDS *
sizeof(u32))), cmdl, sizeof(sa_ctx->epib),
@@ -1367,6 +1380,14 @@ static void sa_sha_dma_in_callback(void *data)
authsize = crypto_ahash_digestsize(tfm);
mdptr = (__be32 *)dmaengine_desc_get_metadata_ptr(rxd->tx_in, &pl, &ml);
+ if (IS_ERR(mdptr)) {
+ dev_err(rxd->ddev, "Failed to get SHA RX metadata pointer: %ld\n",
+ PTR_ERR(mdptr));
+ sa_free_sa_rx_data(rxd);
+ skcipher_request_complete(req, PTR_ERR(mdptr));
+ return;
+ }
+
result = (u32 *)req->result;
for (i = 0; i < (authsize / 4); i++)
@@ -1677,6 +1698,13 @@ static void sa_aead_dma_in_callback(void *data)
authsize = crypto_aead_authsize(tfm);
mdptr = (u32 *)dmaengine_desc_get_metadata_ptr(rxd->tx_in, &pl, &ml);
+ if (IS_ERR(mdptr)) {
+ dev_err(rxd->ddev, "Failed to get AEAD RX metadata pointer: %ld\n",
+ PTR_ERR(mdptr));
+ sa_free_sa_rx_data(rxd);
+ skcipher_request_complete(req, PTR_ERR(mdptr));
+ return;
+ }
for (i = 0; i < (authsize / 4); i++)
mdptr[i + 4] = swab32(mdptr[i + 4]);
--
2.50.1.windows.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] crypto: sa2ul: Add error handling for DMA metadata retrieval
2025-11-13 7:51 [PATCH] crypto: sa2ul: Add error handling for DMA metadata retrieval Haotian Zhang
@ 2025-11-13 18:54 ` kernel test robot
2025-11-13 22:13 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2025-11-13 18:54 UTC (permalink / raw)
To: Haotian Zhang, herbert, davem
Cc: oe-kbuild-all, linux-crypto, linux-kernel, Haotian Zhang
Hi Haotian,
kernel test robot noticed the following build errors:
[auto build test ERROR on herbert-cryptodev-2.6/master]
[also build test ERROR on herbert-crypto-2.6/master linus/master v6.18-rc5 next-20251113]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Haotian-Zhang/crypto-sa2ul-Add-error-handling-for-DMA-metadata-retrieval/20251113-155200
base: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
patch link: https://lore.kernel.org/r/20251113075104.1396-1-vulab%40iscas.ac.cn
patch subject: [PATCH] crypto: sa2ul: Add error handling for DMA metadata retrieval
config: microblaze-randconfig-r073-20251113 (https://download.01.org/0day-ci/archive/20251114/202511140226.Czi6K1Kj-lkp@intel.com/config)
compiler: microblaze-linux-gcc (GCC) 8.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251114/202511140226.Czi6K1Kj-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202511140226.Czi6K1Kj-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/crypto/sa2ul.c: In function 'sa_sha_dma_in_callback':
>> drivers/crypto/sa2ul.c:1387:29: error: passing argument 1 of 'skcipher_request_complete' from incompatible pointer type [-Werror=incompatible-pointer-types]
skcipher_request_complete(req, PTR_ERR(mdptr));
^~~
In file included from drivers/crypto/sa2ul.c:28:
include/crypto/internal/skcipher.h:94:71: note: expected 'struct skcipher_request *' but argument is of type 'struct ahash_request *'
static inline void skcipher_request_complete(struct skcipher_request *req, int err)
~~~~~~~~~~~~~~~~~~~~~~~~~^~~
drivers/crypto/sa2ul.c: In function 'sa_aead_dma_in_callback':
drivers/crypto/sa2ul.c:1705:29: error: passing argument 1 of 'skcipher_request_complete' from incompatible pointer type [-Werror=incompatible-pointer-types]
skcipher_request_complete(req, PTR_ERR(mdptr));
^~~
In file included from drivers/crypto/sa2ul.c:28:
include/crypto/internal/skcipher.h:94:71: note: expected 'struct skcipher_request *' but argument is of type 'struct aead_request *'
static inline void skcipher_request_complete(struct skcipher_request *req, int err)
~~~~~~~~~~~~~~~~~~~~~~~~~^~~
cc1: some warnings being treated as errors
vim +/skcipher_request_complete +1387 drivers/crypto/sa2ul.c
1365
1366 static void sa_sha_dma_in_callback(void *data)
1367 {
1368 struct sa_rx_data *rxd = data;
1369 struct ahash_request *req;
1370 struct crypto_ahash *tfm;
1371 unsigned int authsize;
1372 int i;
1373 size_t ml, pl;
1374 u32 *result;
1375 __be32 *mdptr;
1376
1377 sa_sync_from_device(rxd);
1378 req = container_of(rxd->req, struct ahash_request, base);
1379 tfm = crypto_ahash_reqtfm(req);
1380 authsize = crypto_ahash_digestsize(tfm);
1381
1382 mdptr = (__be32 *)dmaengine_desc_get_metadata_ptr(rxd->tx_in, &pl, &ml);
1383 if (IS_ERR(mdptr)) {
1384 dev_err(rxd->ddev, "Failed to get SHA RX metadata pointer: %ld\n",
1385 PTR_ERR(mdptr));
1386 sa_free_sa_rx_data(rxd);
> 1387 skcipher_request_complete(req, PTR_ERR(mdptr));
1388 return;
1389 }
1390
1391 result = (u32 *)req->result;
1392
1393 for (i = 0; i < (authsize / 4); i++)
1394 result[i] = be32_to_cpu(mdptr[i + 4]);
1395
1396 sa_free_sa_rx_data(rxd);
1397
1398 ahash_request_complete(req, 0);
1399 }
1400
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] crypto: sa2ul: Add error handling for DMA metadata retrieval
2025-11-13 7:51 [PATCH] crypto: sa2ul: Add error handling for DMA metadata retrieval Haotian Zhang
2025-11-13 18:54 ` kernel test robot
@ 2025-11-13 22:13 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2025-11-13 22:13 UTC (permalink / raw)
To: Haotian Zhang, herbert, davem
Cc: llvm, oe-kbuild-all, linux-crypto, linux-kernel, Haotian Zhang
Hi Haotian,
kernel test robot noticed the following build errors:
[auto build test ERROR on herbert-cryptodev-2.6/master]
[also build test ERROR on herbert-crypto-2.6/master linus/master v6.18-rc5 next-20251113]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Haotian-Zhang/crypto-sa2ul-Add-error-handling-for-DMA-metadata-retrieval/20251113-155200
base: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
patch link: https://lore.kernel.org/r/20251113075104.1396-1-vulab%40iscas.ac.cn
patch subject: [PATCH] crypto: sa2ul: Add error handling for DMA metadata retrieval
config: loongarch-randconfig-002-20251113 (https://download.01.org/0day-ci/archive/20251114/202511140542.Z9DpLPyb-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 0bba1e76581bad04e7d7f09f5115ae5e2989e0d9)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251114/202511140542.Z9DpLPyb-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202511140542.Z9DpLPyb-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/crypto/sa2ul.c:1387:29: error: incompatible pointer types passing 'struct ahash_request *' to parameter of type 'struct skcipher_request *' [-Wincompatible-pointer-types]
1387 | skcipher_request_complete(req, PTR_ERR(mdptr));
| ^~~
include/crypto/internal/skcipher.h:94:71: note: passing argument to parameter 'req' here
94 | static inline void skcipher_request_complete(struct skcipher_request *req, int err)
| ^
>> drivers/crypto/sa2ul.c:1705:29: error: incompatible pointer types passing 'struct aead_request *' to parameter of type 'struct skcipher_request *' [-Wincompatible-pointer-types]
1705 | skcipher_request_complete(req, PTR_ERR(mdptr));
| ^~~
include/crypto/internal/skcipher.h:94:71: note: passing argument to parameter 'req' here
94 | static inline void skcipher_request_complete(struct skcipher_request *req, int err)
| ^
2 errors generated.
vim +1387 drivers/crypto/sa2ul.c
1365
1366 static void sa_sha_dma_in_callback(void *data)
1367 {
1368 struct sa_rx_data *rxd = data;
1369 struct ahash_request *req;
1370 struct crypto_ahash *tfm;
1371 unsigned int authsize;
1372 int i;
1373 size_t ml, pl;
1374 u32 *result;
1375 __be32 *mdptr;
1376
1377 sa_sync_from_device(rxd);
1378 req = container_of(rxd->req, struct ahash_request, base);
1379 tfm = crypto_ahash_reqtfm(req);
1380 authsize = crypto_ahash_digestsize(tfm);
1381
1382 mdptr = (__be32 *)dmaengine_desc_get_metadata_ptr(rxd->tx_in, &pl, &ml);
1383 if (IS_ERR(mdptr)) {
1384 dev_err(rxd->ddev, "Failed to get SHA RX metadata pointer: %ld\n",
1385 PTR_ERR(mdptr));
1386 sa_free_sa_rx_data(rxd);
> 1387 skcipher_request_complete(req, PTR_ERR(mdptr));
1388 return;
1389 }
1390
1391 result = (u32 *)req->result;
1392
1393 for (i = 0; i < (authsize / 4); i++)
1394 result[i] = be32_to_cpu(mdptr[i + 4]);
1395
1396 sa_free_sa_rx_data(rxd);
1397
1398 ahash_request_complete(req, 0);
1399 }
1400
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-11-13 22:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-13 7:51 [PATCH] crypto: sa2ul: Add error handling for DMA metadata retrieval Haotian Zhang
2025-11-13 18:54 ` kernel test robot
2025-11-13 22:13 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).