[PATCH v2] crypto: sa2ul: Add error handling for DMA metadata retrieval

[PATCH v2] crypto: sa2ul: Add error handling for DMA metadata retrieval

[Haotian Zhang]

The SA2UL driver calls dmaengine_desc_get_metadata_ptr() in AES, SHA and
AEAD DMA paths without checking for error pointers. If the metadata
retrieval fails, these functions may dereference an ERR_PTR value,
leading to kernel crashes or undefined behavior.

Add proper IS_ERR() checks after each dmaengine_desc_get_metadata_ptr()
call, log the failure, clean up the DMA state, and complete the crypto
request with an error.
Fixes: 7694b6ca649f ("crypto: sa2ul - Add crypto driver")
Fixes: 2dc53d004745 ("crypto: sa2ul - add sha1/sha256/sha512 support")
Fixes: d2c8ac187fc9 ("crypto: sa2ul - Add AEAD algorithm support")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
Changes in v2:
  -fix the misuse of skcipher_request_complete().
---
 drivers/crypto/sa2ul.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
index fdc0b2486069..93afe7c6a3e1 100644
--- a/drivers/crypto/sa2ul.c
+++ b/drivers/crypto/sa2ul.c
@@ -1051,6 +1051,13 @@ static void sa_aes_dma_in_callback(void *data)
 	if (req->iv) {
 		mdptr = (__be32 *)dmaengine_desc_get_metadata_ptr(rxd->tx_in, &pl,
 							       &ml);
+		if (IS_ERR(mdptr)) {
+			dev_err(rxd->ddev, "Failed to get AES RX metadata pointer: %ld\n",
+				PTR_ERR(mdptr));
+			sa_free_sa_rx_data(rxd);
+			skcipher_request_complete(req, PTR_ERR(mdptr));
+			return;
+		}
 		result = (u32 *)req->iv;
 
 		for (i = 0; i < (rxd->enc_iv_size / 4); i++)
@@ -1272,6 +1279,12 @@ static int sa_run(struct sa_req *req)
 	 * crypto algorithm to be used, data sizes, different keys etc.
 	 */
 	mdptr = (u32 *)dmaengine_desc_get_metadata_ptr(tx_out, &pl, &ml);
+	if (IS_ERR(mdptr)) {
+		dev_err(pdata->dev, "Failed to get TX metadata pointer: %ld\n",
+			PTR_ERR(mdptr));
+		ret = PTR_ERR(mdptr);
+		goto err_cleanup;
+	}
 
 	sa_prepare_tx_desc(mdptr, (sa_ctx->cmdl_size + (SA_PSDATA_CTX_WORDS *
 				   sizeof(u32))), cmdl, sizeof(sa_ctx->epib),
@@ -1367,6 +1380,14 @@ static void sa_sha_dma_in_callback(void *data)
 	authsize = crypto_ahash_digestsize(tfm);
 
 	mdptr = (__be32 *)dmaengine_desc_get_metadata_ptr(rxd->tx_in, &pl, &ml);
+	if (IS_ERR(mdptr)) {
+		dev_err(rxd->ddev, "Failed to get SHA RX metadata pointer: %ld\n",
+			PTR_ERR(mdptr));
+		sa_free_sa_rx_data(rxd);
+		ahash_request_complete(req, PTR_ERR(mdptr));
+		return;
+	}
+
 	result = (u32 *)req->result;
 
 	for (i = 0; i < (authsize / 4); i++)
@@ -1677,6 +1698,13 @@ static void sa_aead_dma_in_callback(void *data)
 	authsize = crypto_aead_authsize(tfm);
 
 	mdptr = (u32 *)dmaengine_desc_get_metadata_ptr(rxd->tx_in, &pl, &ml);
+	if (IS_ERR(mdptr)) {
+		dev_err(rxd->ddev, "Failed to get AEAD RX metadata pointer: %ld\n",
+			PTR_ERR(mdptr));
+		sa_free_sa_rx_data(rxd);
+		aead_request_complete(req, PTR_ERR(mdptr));
+		return;
+	}
 	for (i = 0; i < (authsize / 4); i++)
 		mdptr[i + 4] = swab32(mdptr[i + 4]);
 
-- 
2.50.1.windows.1

Re: [PATCH v2] crypto: sa2ul: Add error handling for DMA metadata retrieval

[Dan Carpenter]

Hi Haotian,

kernel test robot noticed the following build warnings:

https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Haotian-Zhang/crypto-sa2ul-Add-error-handling-for-DMA-metadata-retrieval/20251117-103258
base:   https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
patch link:    https://lore.kernel.org/r/20251117023117.90-1-vulab%40iscas.ac.cn
patch subject: [PATCH v2] crypto: sa2ul: Add error handling for DMA metadata retrieval
config: m68k-randconfig-r073-20251119 (https://download.01.org/0day-ci/archive/20251119/202511191706.iBCITtX2-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 11.5.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202511191706.iBCITtX2-lkp@intel.com/

smatch warnings:
drivers/crypto/sa2ul.c:1064 sa_aes_dma_in_callback() warn: 'mdptr' can also be NULL
drivers/crypto/sa2ul.c:1394 sa_sha_dma_in_callback() warn: 'mdptr' can also be NULL
drivers/crypto/sa2ul.c:1709 sa_aead_dma_in_callback() warn: 'mdptr' can also be NULL

vim +/mdptr +1064 drivers/crypto/sa2ul.c

7694b6ca649fea Keerthy        2020-07-13  1039  static void sa_aes_dma_in_callback(void *data)
7694b6ca649fea Keerthy        2020-07-13  1040  {
aedf818b1f1965 Yu Zhe         2023-03-17  1041  	struct sa_rx_data *rxd = data;
7694b6ca649fea Keerthy        2020-07-13  1042  	struct skcipher_request *req;
7694b6ca649fea Keerthy        2020-07-13  1043  	u32 *result;
7694b6ca649fea Keerthy        2020-07-13  1044  	__be32 *mdptr;
7694b6ca649fea Keerthy        2020-07-13  1045  	size_t ml, pl;
7694b6ca649fea Keerthy        2020-07-13  1046  	int i;
7694b6ca649fea Keerthy        2020-07-13  1047  
00c9211f60db2d Peter Ujfalusi 2020-09-23  1048  	sa_sync_from_device(rxd);
7694b6ca649fea Keerthy        2020-07-13  1049  	req = container_of(rxd->req, struct skcipher_request, base);
7694b6ca649fea Keerthy        2020-07-13  1050  
7694b6ca649fea Keerthy        2020-07-13  1051  	if (req->iv) {
7694b6ca649fea Keerthy        2020-07-13  1052  		mdptr = (__be32 *)dmaengine_desc_get_metadata_ptr(rxd->tx_in, &pl,
7694b6ca649fea Keerthy        2020-07-13  1053  							       &ml);


The Kconfig file should probably enforce that CONFIG_DMA_ENGINE
is set.  Otherwise dmaengine_desc_get_metadata_ptr() returns NULL.

90d79e983588a8 Haotian Zhang  2025-11-17  1054  		if (IS_ERR(mdptr)) {
90d79e983588a8 Haotian Zhang  2025-11-17  1055  			dev_err(rxd->ddev, "Failed to get AES RX metadata pointer: %ld\n",
90d79e983588a8 Haotian Zhang  2025-11-17  1056  				PTR_ERR(mdptr));
90d79e983588a8 Haotian Zhang  2025-11-17  1057  			sa_free_sa_rx_data(rxd);
90d79e983588a8 Haotian Zhang  2025-11-17  1058  			skcipher_request_complete(req, PTR_ERR(mdptr));
90d79e983588a8 Haotian Zhang  2025-11-17  1059  			return;
90d79e983588a8 Haotian Zhang  2025-11-17  1060  		}
7694b6ca649fea Keerthy        2020-07-13  1061  		result = (u32 *)req->iv;
7694b6ca649fea Keerthy        2020-07-13  1062  
7694b6ca649fea Keerthy        2020-07-13  1063  		for (i = 0; i < (rxd->enc_iv_size / 4); i++)
7694b6ca649fea Keerthy        2020-07-13 @1064  			result[i] = be32_to_cpu(mdptr[i + rxd->iv_idx]);
7694b6ca649fea Keerthy        2020-07-13  1065  	}
7694b6ca649fea Keerthy        2020-07-13  1066  
00c9211f60db2d Peter Ujfalusi 2020-09-23  1067  	sa_free_sa_rx_data(rxd);
7694b6ca649fea Keerthy        2020-07-13  1068  
7694b6ca649fea Keerthy        2020-07-13  1069  	skcipher_request_complete(req, 0);
7694b6ca649fea Keerthy        2020-07-13  1070  }

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki