[PATCH AUTOSEL 6.18-5.10] crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y

[PATCH AUTOSEL 6.18-5.10] crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y

[Sasha Levin]

From: Lukas Wunner <lukas@wunner.de>

[ Upstream commit c64ba13e2033c3c6dc1a097bf35f9f1fe457c3f7 ]

Andrew reports build breakage of arm allmodconfig, reproducible with gcc
14.2.0 and 15.2.0:

  crypto/ecc.c: In function 'ecc_point_mult':
  crypto/ecc.c:1380:1: error: the frame size of 1360 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]

gcc aggressively inlines functions called by ecc_point_mult() (without
there being any explicit inline declarations), which pushes stack usage
close to the limit imposed by CONFIG_FRAME_WARN.  allmodconfig implies
CONFIG_KASAN_STACK=y, which increases the stack above that limit.

In the bugzilla entry linked below, gcc maintainers explain that gcc
estimates extra stack usage caused by inlining, but ASAN instrumentation
is added in post-IPA passes and thus the inlining heuristics cannot
account for it.

It could be argued that -Werror=frame-larger-than=1280 instructs the
compiler to avoid inlining beyond that limit lest the build breaks,
which would imply gcc behaves incorrectly.  But gcc maintainers reject
this notion and believe that a warning switch should never affect code
generation, even if it is promoted to an error.

One way to unbreak the build is to limit inlining via -finline-limit=100
or by explicitly declaring some functions noinline.  However while it
does keep stack usage of individual functions below the limit, *total*
stack usage increases.

A longterm solution is to refactor ecc.c for reduced stack usage.  It
currently performs ECC point multiplication with a Montgomery ladder
which uses co-Z (conjugate) addition to trade off memory for speed.
The algorithm is susceptible to timing attacks and needs to be replaced
with a constant time Montgomery ladder, which should consume less memory
and thus resolve the stack usage issue as a side effect.

In the interim, raise the limit for ecc.c, as is already done for
several other files in the source tree.

Constrain to gcc because clang 19.1.7 does not exhibit the issue.  It
makes do with a 724 bytes stack frame even though it inlines almost the
same functions as gcc.

Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124949
Reported-by: Andrew Morton <akpm@linux-foundation.org> # off-list
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: `crypto: ecc - Unbreak the build on arm with
CONFIG_KASAN_STACK=y`

**Local tree:** Linux **6.18.43** (`git describe HEAD` →
`v6.18.43-1-gc7f0dac02d232`)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject line
**Record:** `[crypto/ecc] [unbreak/fix build] [raise frame-size warning
limit for ecc.o on arm+KASAN_STACK+gcc to fix allmodconfig build
failure]`

### Step 1.2: Tags
**Record:**
| Tag | Value |
|-----|-------|
| Link | https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124949 |
| Reported-by | Andrew Morton \<akpm@linux-foundation.org\> (off-list) |
| Signed-off-by | Lukas Wunner \<lukas@wunner.de\> |
| Acked-by | Andy Shevchenko \<andriy.shevchenko@linux.intel.com\> |
| Reviewed-by | Andy Shevchenko \<andriy.shevchenko@linux.intel.com\> |
| Signed-off-by | Herbert Xu \<herbert@gondor.apana.org.au\> (crypto
maintainer) |
| Fixes: | absent (expected) |
| Cc: stable | absent (expected) |

**Notable:** Reported by Andrew Morton; crypto maintainer sign-off; gcc
bugzilla link; no syzbot.

### Step 1.3: Body analysis
**Record:**
- **Bug:** `arm allmodconfig` fails to build with gcc 14.2.0/15.2.0 when
  `CONFIG_KASAN_STACK=y`.
- **Symptom:** `-Werror=frame-larger-than` error in `ecc_point_mult()` —
  frame 1360 bytes > 1280-byte limit.
- **Root cause:** GCC aggressively inlines into `ecc_point_mult()`;
  KASAN stack instrumentation is added post-IPA and is not accounted for
  in inlining heuristics.
- **Fix approach:** Interim workaround — raise per-object `-Wframe-
  larger-than` to 1536 for `ecc.o` under `CONFIG_ARM &&
  CONFIG_KASAN_STACK && CONFIG_CC_IS_GCC`.
- **Version info:** Triggered by newer gcc (14/15); clang 19.1.7 not
  affected.

### Step 1.4: Hidden bug fix?
**Record:** Not a hidden runtime bug fix. This is an explicit **build
fix** — a Makefile-only workaround for a compiler/KASAN interaction. No
runtime behavior change.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory
**Record:**
- **Files:** `crypto/Makefile` only (+5 lines)
- **Functions modified:** none (build flags only)
- **Scope:** Single-file, surgical Makefile change

### Step 2.2: Code flow per hunk
**Record:**
- **Before:** Global `CONFIG_FRAME_WARN` (1280 on 32-bit) applies to
  `ecc.o`; gcc+KASAN_STACK can push `ecc_point_mult()` past that limit →
  build error with `-Werror`.
- **After:** When `CONFIG_ARM=y`, `CONFIG_KASAN_STACK=y`, and
  `CONFIG_CC_IS_GCC=y`, add `CFLAGS_ecc.o += -Wframe-larger-than=1536`
  for that object only.
- **Path affected:** Compile-time only; no execution-path change.

### Step 2.3: Bug mechanism
**Record:** **Build fix / toolchain interaction** — not UAF, leak, race,
etc. GCC stack-frame estimate plus KASAN instrumentation exceeds the
kernel’s default 32-bit `FRAME_WARN` (1280), promoted to error under
`WERROR`/allmodconfig.

### Step 2.4: Fix quality
**Record:**
- **Quality:** High — matches existing pattern in the same Makefile
  (`CFLAGS_blake2b_generic.o := -Wframe-larger-than=4096`).
- **Regression risk:** Very low — only relaxes a compile-time warning
  threshold for one object under a narrow config triple; no code
  generation change intended.
- **Caveat:** Does not reduce actual stack use; silences the warning
  until a future ECC refactor.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:**
- `ecc_point_mult()` at `crypto/ecc.c:1338` — present at Linux 6.18.43
  tag (`7b923c78b50d2`).
- `CFLAGS_blake2b_generic.o` precedent at `crypto/Makefile:87` — same
  gcc frame-size workaround pattern already in this tree.
- Blame on this stable checkout points at bulk import commit
  `a112b91dd6349`; per-file history is not granular here.

### Step 3.2: Fixes: tag
**Record:** N/A — no `Fixes:` tag.

### Step 3.3: Related file history
**Record:**
- `crypto/Makefile` at 6.18.43 has `obj-$(CONFIG_CRYPTO_ECC) += ecc.o`
  with **no** `CFLAGS_ecc.o` workaround — fix is **not** present.
- Commit under review **not found** in local `master` or current HEAD
  via grep/log search — likely newer mainline crypto work being
  evaluated for stable.

### Step 3.4: Author context
**Record:** Lukas Wunner is a regular kernel contributor; Herbert Xu
(crypto maintainer) merged. Andy Shevchenko acked/reviewed.

### Step 3.5: Dependencies
**Record:** Standalone — no series, no prerequisite commits, no new
APIs. Applies after `obj-$(CONFIG_CRYPTO_ECC) += ecc.o` line in
Makefile.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Patch discussion
**Record:** `b4 dig -c <hash>` could not run — commit hash not in this
repository. Lore and gcc bugzilla returned HTTP 403 from this
environment.

### Step 4.2: Reviewers
**Record:** UNVERIFIED via b4 -w. From commit message: Andy Shevchenko
(Acked-by + Reviewed-by), Herbert Xu (merge SOB).

### Step 4.3: Bug report
**Record:** Andrew Morton off-list report (high credibility for
allmodconfig breakage). gcc BZ #124949 explains gcc/KASAN stack-
estimation mismatch — URL not fetchable here.

### Step 4.4: Related patches
**Record:** Commit references long-term ECC constant-time refactor; this
patch is explicitly interim. No other patches required for this fix to
work.

### Step 4.5: Stable list
**Record:** UNVERIFIED — lore 403 blocked search.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key functions
**Record:** No functions modified. Affected compile unit: `ecc.o` →
contains `ecc_point_mult()` and ECC helpers.

### Step 5.2: Callers
**Record:** `ecc_point_mult()` is called from `ecc_point_mult_shamir()`,
key generation, and scalar-multiply paths in `crypto/ecc.c` (lines 1593,
1661, 1708). Used when `CONFIG_CRYPTO_ECC` and dependent algorithms
(ECDH, ECDSA, ECRDSA) are enabled.

### Step 5.3: Callees
**Record:** Montgomery-ladder ECC math (`xycz_add`, `vli_mod_mult_fast`,
etc.) — large on-stack `u64` arrays (`ECC_MAX_DIGITS` = 9 → 72 bytes per
array; multiple arrays in `ecc_point_mult`).

### Step 5.4: Reachability
**Record:** Runtime path is reachable via crypto/KPP when ECC is
enabled. **The patch does not change this** — only whether the object
compiles under arm+KASAN+gcc+WERROR.

### Step 5.5: Similar patterns
**Record:** Same Makefile already has:
- `CFLAGS_blake2b_generic.o := -Wframe-larger-than=4096` (gcc BZ 105930)
- `arch/arm/boot/compressed/Makefile` per-object frame limit override
- `arch/powerpc/xmon/Makefile` clang frame override

---

## PHASE 6: CROSS-REFERENCE AGAINST LOCAL TREE (6.18.43)

### Step 6.1: Buggy code present?
**Record:** **YES.** `crypto/ecc.c` with `ecc_point_mult()` exists at
6.18.43. Relevant Kconfig exists:
- `CONFIG_FRAME_WARN` default **1280** for `!64BIT`
  (`lib/Kconfig.debug:448`)
- `CONFIG_KASAN_STACK` default **y** for GCC (`lib/Kconfig.kasan:167`)
- Global `-Wframe-larger-than=$(CONFIG_FRAME_WARN)` in
  `scripts/Makefile.extrawarn:25`
- `CONFIG_CRYPTO_ECC` / `ecc.o` build in `crypto/Makefile:183`

Fix is **not** yet in this tree.

### Step 6.2: Backport complications
**Record:** **Clean apply expected** — 5 lines inserted immediately
after `obj-$(CONFIG_CRYPTO_ECC) += ecc.o`. No conflicting changes at
that location in 6.18.43.

### Step 6.3: Related fixes already present?
**Record:** **NO** — `grep CFLAGS_ecc` returns nothing. Blake2b
precedent exists; ecc-specific workaround does not.

---

## PHASE 7: SUBSYSTEM CONTEXT

### Step 7.1: Subsystem criticality
**Record:** **crypto** — IMPORTANT subsystem. This patch affects
buildability, not runtime crypto behavior.

### Step 7.2: Activity
**Record:** `crypto/ecc.c` is mature, relatively stable code. Issue is
toolchain-driven (gcc 14/15 + KASAN), not a recent kernel regression in
ECC logic.

---

## PHASE 8: IMPACT AND RISK

### Step 8.1: Who is affected
**Record:** **Config-specific builders** — developers/CI running
**32-bit ARM** (`CONFIG_ARM`) **allmodconfig** (or similar) with
**GCC**, **KASAN** (`CONFIG_KASAN_STACK=y`), and **WERROR**. Not typical
production distro arm32 kernels (KASAN usually off).

### Step 8.2: Trigger conditions
**Record:**
- `CONFIG_ARM=y` (32-bit, not arm64)
- `CONFIG_CC_IS_GCC=y`
- `CONFIG_KASAN_STACK=y` (default y for GCC)
- gcc 14.2+ with aggressive inlining
- `CONFIG_FRAME_WARN=1280` (32-bit default) + warnings-as-errors

**Likelihood:** Low for end users; **high** for kernel compile-test/CI
on arm allmodconfig. Andrew Morton’s report indicates it blocks a
standard maintainer build configuration.

### Step 8.3: Failure mode severity
**Record:** **Build failure** (compiler error). Severity for runtime
users: **NONE**. Severity for kernel development/CI: **MEDIUM** (blocks
full config testing).

### Step 8.4: Risk-benefit
**Record:**
- **Benefit:** Unblocks arm allmodconfig builds with modern gcc;
  restores parity with existing blake2b workaround pattern; zero runtime
  change.
- **Risk:** Very low — Makefile-only, narrow `ifeq` guard, per-object
  flag.
- **Ratio:** Favorable for stable as a **build-fix exception**,
  especially with Andrew Morton report and maintainer acks.

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence summary

**FOR backport:**
- Explicit build fix; fits documented stable exception category
- Andrew Morton reported arm allmodconfig breakage
- Herbert Xu merged; Andy Shevchenko acked/reviewed
- Tiny (5 lines), precedented in same `crypto/Makefile`
- Buggy build conditions exist in 6.18.43; fix not yet applied
- Clean apply expected; no dependencies
- Enables kernel-wide compile testing on arm with modern gcc

**AGAINST backport:**
- No runtime bug — production kernels rarely use KASAN+allmodconfig on
  arm32
- Workaround, not a reduction of actual stack usage
- Very narrow config intersection (arm32 + gcc + KASAN_STACK)
- Commit not yet in local `master` (timing/unverified upstream merge
  status)
- External discussion (lore, gcc BZ) not accessible from this
  environment

**Unresolved:**
- Full lore review thread unavailable (403)
- gcc BZ #124949 details not fetchable (403)
- Exact upstream commit SHA not in this repo

### Step 9.2: Stable rules checklist
| Criterion | Result |
|-----------|--------|
| 1. Obviously correct and tested? | **PASS** — Makefile pattern proven
by blake2b entry; maintainer reviewed |
| 2. Fixes real bug affecting users? | **PASS** — real build failure for
arm allmodconfig; builder/CI impact |
| 3. Important issue? | **PASS (build/CI)** — not crash/security; blocks
standard compile-test config |
| 4. Small and contained? | **PASS** — 5 lines, one file |
| 5. No new features/APIs? | **PASS** — compiler flag only |
| 6. Applies to local tree? | **PASS** — ecc.c and Kconfig preconditions
present; fix absent |

### Step 9.3: Exception category
**Record:** **BUILD FIX** — compilation failure under `CONFIG_ARM` +
`CONFIG_KASAN_STACK` + GCC + `-Werror=frame-larger-than`.

### Step 9.4: Decision rationale

For **Linux 6.18.43**, this commit should be backported. The ECC code
and all triggering Kconfig defaults exist in this tree, the fix is
absent, and the patch is a minimal Makefile workaround following an
established pattern already present in `crypto/Makefile`. While it does
not fix a runtime crash or security issue, it unblocks a standard kernel
build configuration (arm allmodconfig with modern gcc and KASAN)
reported by Andrew Morton, with crypto maintainer approval — exactly the
kind of contained build fix stable trees routinely carry.

---

## Verification

- **[Phase 1]** Parsed subject, tags, body from user-provided commit
  message
- **[Phase 2]** Analyzed provided diff: +5 lines in `crypto/Makefile`
  only
- **[Phase 3]** `git describe HEAD` → v6.18.43; `make kernelversion` →
  6.18.43
- **[Phase 3]** `git log --grep` for commit subject/hash — not found in
  tree
- **[Phase 3]** `git show 7b923c78b50d2:crypto/ecc.c` — `ecc_point_mult`
  at line 1338 confirmed
- **[Phase 3]** `git show 7b923c78b50d2:crypto/Makefile` — no
  `CFLAGS_ecc.o` workaround
- **[Phase 3]** `git blame crypto/Makefile:87` — blake2b frame-larger
  precedent present
- **[Phase 4]** `b4 dig` — failed (no commit hash in repo)
- **[Phase 4]** lore.kernel.org curl — HTTP 403
- **[Phase 4]** gcc.gnu.org bugzilla #124949 — HTTP 403
- **[Phase 5]** Read `crypto/ecc.c:1338-1398` — large on-stack arrays in
  `ecc_point_mult`
- **[Phase 5]** `grep ecc_point_mult crypto/ecc.c` — callers at 1593,
  1661, 1708
- **[Phase 5]** `include/crypto/internal/ecc.h:37` — `ECC_MAX_DIGITS =
  DIV_ROUND_UP(521, 64)` (= 9)
- **[Phase 6]** `grep CFLAGS_ecc / KASAN_STACK / Wframe-larger-than`
  across tree
- **[Phase 6]** Read `lib/Kconfig.debug:441-453` — FRAME_WARN default
  1280 for !64BIT
- **[Phase 6]** Read `lib/Kconfig.kasan:163-179` — KASAN_STACK default y
  for GCC
- **[Phase 6]** Read `init/Kconfig:227-232` — WERROR defaults to
  COMPILE_TEST
- **[Phase 6]** Read `scripts/Makefile.extrawarn:24-26` — global frame-
  larger-than flag
- **[Phase 6]** Read `crypto/Makefile:183-184` — ECC object build rule,
  no workaround yet
- **UNVERIFIED:** Full mailing-list review thread and gcc BZ discussion
  text (HTTP 403)
- **UNVERIFIED:** Whether commit is already merged to mainline outside
  this checkout

**YES**

 crypto/Makefile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/crypto/Makefile b/crypto/Makefile
index e430e6e99b6a2..ef963cc03a038 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -183,6 +183,11 @@ obj-$(CONFIG_CRYPTO_ZSTD) += zstd.o
 obj-$(CONFIG_CRYPTO_ECC) += ecc.o
 obj-$(CONFIG_CRYPTO_ESSIV) += essiv.o
 
+# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124949
+ifeq ($(CONFIG_ARM)$(CONFIG_KASAN_STACK)$(CONFIG_CC_IS_GCC),yyy)
+CFLAGS_ecc.o += $(call cc-option,-Wframe-larger-than=1536)
+endif
+
 ecdh_generic-y += ecdh.o
 ecdh_generic-y += ecdh_helper.o
 obj-$(CONFIG_CRYPTO_ECDH) += ecdh_generic.o
-- 
2.53.0

[PATCH AUTOSEL 6.18-6.6] crypto: omap - add omap_des_unregister_algs helper

[Sasha Levin]

From: Thorsten Blum <thorsten.blum@linux.dev>

[ Upstream commit 9ab1392b1163daab674484d6ddacf16f0ad4c040 ]

Add a new helper omap_des_unregister_algs() and replace two for loops in
omap_des_probe() and omap_des_remove(), which also ensure ->registered
is reset to 0.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: `crypto: omap - add omap_des_unregister_algs
helper`

**Local tree:** Linux **6.18.43** (`v6.18.43-1-gc7f0dac02d232`)
**Upstream commit:** `9ab1392b1163daab674484d6ddacf16f0ad4c040`
**Stable-queue commit (not in HEAD):**
`18e80df6bcd291829f7f5251bafb8567a31bf25c`

---

## PHASE 1: COMMIT MESSAGE FORENSICS

**Step 1.1 — Subject line**
Record: `[crypto: omap] [add] add omap_des_unregister_algs helper` —
introduces a helper and consolidates unregister logic.

**Step 1.2 — Tags**
Record:
- `Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>` (author)
- `Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>` (crypto
  maintainer)
- No `Fixes:`, `Reported-by:`, `Cc: stable@vger.kernel.org`, `Link:`,
  `Tested-by:`, or `Reviewed-by:` tags
- Notable: maintainer sign-off only; no fuzzer or user reports

**Step 1.3 — Body**
Record:
- **Bug described:** Implicit — `->registered` must be reset to 0 when
  algorithms are unregistered
- **Symptom/failure mode:** Not stated explicitly; stale `registered`
  counter after probe error path or remove
- **Version info:** None
- **Root cause (author):** Two duplicate unregister loops did not reset
  `registered`

**Step 1.4 — Hidden bug fix?**
Record: **Yes.** Despite “add helper” wording, the behavioral fix is
`alg_info->registered = 0` after unregister. Without that, the static
`registered` counter grows across probe/remove cycles while the
unregister loops use the inflated value.

---

## PHASE 2: DIFF ANALYSIS

**Step 2.1 — Inventory**
Record:
- **File:** `drivers/crypto/omap-des.c` (+16 / −10 lines, ~26 lines
  touched)
- **Functions:** new `omap_des_unregister_algs()`; modified
  `omap_des_probe()` (`err_algs`), `omap_des_remove()`
- **Scope:** Single-file surgical refactor + correctness fix

**Step 2.2 — Code flow per hunk**

| Hunk | Before | After |
|------|--------|-------|
| New helper | N/A | Iterates `algs_info` groups, calls
`crypto_engine_unregister_skciphers(algs_list, registered)`, sets
`registered = 0` |
| `err_algs` | Nested loops calling
`crypto_engine_unregister_skcipher()` per entry | Calls
`omap_des_unregister_algs(dd->pdata)` |
| `omap_des_remove()` | Same nested loops, no counter reset | Calls
`omap_des_unregister_algs(dd->pdata)` |

Record: Error path and normal remove path now share identical
unregister+reset logic.

**Step 2.3 — Bug mechanism**
Record:
- **Category:** Logic/correctness + potential out-of-bounds access
- **Mechanism:** `omap_des_algs_info_ecb_cbc` is static; `registered` is
  mutated during probe (`registered++` per successful
  `crypto_engine_register_skcipher()`). Old `err_algs` and `remove`
  unregistered algorithms but left `registered` non-zero. On a
  subsequent probe within the same module lifetime (driver rebind
  without `rmmod`), probe registers all 4 algorithms again while
  incrementing from the stale value (e.g. 4 → 8). The next remove
  iterates `j = registered-1 … 0`, accessing `algs_list[4..7]` when the
  array has only 4 elements (`ecb(des)`, `cbc(des)`, `ecb(des3_ede)`,
  `cbc(des3_ede)`).

Unlike `omap-aes.c`, which guards re-registration with `if
(!registered)` and decrements on remove, `omap-des.c` has no such guard
— making stale `registered` directly dangerous.

**Step 2.4 — Fix quality**
Record:
- Fix is obviously correct: reset counter after unregister
- Minimal, no API changes
- `crypto_engine_unregister_skciphers()` is equivalent to the old per-
  entry loop (verified in `crypto/crypto_engine.c:654-661`)
- Regression risk: very low

---

## PHASE 3: GIT HISTORY INVESTIGATION

**Step 3.1 — Blame**
Record: Current unregister loops in HEAD blame to `5d324e5159d9e` (v6.18
merge import). The `registered` field and buggy pattern are present in
this tree’s `omap-des.c`.

**Step 3.2 — Fixes: tag**
Record: N/A — no `Fixes:` tag.

**Step 3.3 — Related file history**
Record:
- Part of a 3-patch series by Thorsten Blum (Apr 27, 2026):
  1. `omap_aes_unregister_algs` (`c207524b73f8`)
  2. **`omap_des_unregister_algs`** (`9ab1392b1163`) — this commit
  3. `Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly`
     (`2ed27b5a1174`) — unrelated OMAP scatterlist fix
- This omap-des patch is **standalone**; it does not depend on the aes
  or scatterlist patches

**Step 3.4 — Author context**
Record: Thorsten Blum submitted a series of OMAP crypto driver
correctness fixes in 2026; Herbert Xu committed them upstream May 7,
2026. Same pattern applied to `omap-aes.c`.

**Step 3.5 — Dependencies**
Record: No prerequisites. `crypto_engine_unregister_skciphers()` exists
in this tree (`crypto/crypto_engine.c`, `include/crypto/engine.h`).
Patch applies cleanly to current `omap-des.c`.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

**Step 4.1 — Original discussion**
Record: `b4 dig -c 18e80df6bcd291829f7f5251bafb8567a31bf25c` matched
[PATCH 2/3] at `https://lore.kernel.org/all/20260427172018.416707-5-
thorsten.blum@linux.dev/`. Lore page content could not be fetched
(Anubis bot protection). Patch content matches committed diff.

**Step 4.2 — Reviewers**
Record: `b4 dig -w` — CC’d Herbert Xu, David S. Miller, `linux-
crypto@vger.kernel.org`, `linux-kernel@vger.kernel.org`.

**Step 4.3 — Bug reports**
Record: N/A — no `Reported-by:` or `Link:` tags; no syzbot report.

**Step 4.4 — Series context**
Record: v1 series `[PATCH 1/3]` through `[PATCH 3/3]`; omap-des patch is
self-contained within its file.

**Step 4.5 — Stable list**
Record: Could not search `lore.kernel.org/stable/` (same fetch
restriction). No stable nomination found in available sources.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

**Step 5.1 — Key functions**
Record: `omap_des_unregister_algs()`, `omap_des_probe()`,
`omap_des_remove()`

**Step 5.2 — Callers**
Record:
- `omap_des_probe()` — platform driver probe (`module_platform_driver`)
- `omap_des_remove()` — platform driver remove
- `err_algs` — probe error path when `crypto_engine_register_skcipher()`
  fails

**Step 5.3 — Callees**
Record: `crypto_engine_unregister_skciphers()` →
`crypto_engine_unregister_skcipher()` → `crypto_unregister_skcipher()` →
`crypto_unregister_alg()` (WARNs if algorithm not registered:
`crypto/algapi.c:498`)

**Step 5.4 — Reachability**
Record: Triggered by driver rebind (`unbind`/`bind` sysfs) or probe
failure followed by re-probe, without module unload. Requires
`CONFIG_CRYPTO_DEV_OMAP_DES` on OMAP2+ hardware. Not syscall-reachable,
but reachable by root via driver sysfs or module lifecycle.

**Step 5.5 — Similar patterns**
Record: `omap-aes.c` in this tree still uses manual loops with
decrement-on-remove and `if (!registered)` probe guard — partial
mitigation omap-des lacks. Other drivers (`atmel-aes.c`, `sun8i-ss-
core.c`, etc.) use dedicated `*_unregister_algs()` helpers that reset
state.

---

## PHASE 6: CROSS-REFERENCE AGAINST LOCAL TREE (6.18.43)

**Step 6.1 — Buggy code present?**
Record: **Yes.** HEAD `drivers/crypto/omap-des.c` lines 1045–1049
(`err_algs`) and 1076–1079 (`remove`) use old nested loops without
resetting `registered`. Commit `9ab1392b1163` is **not** an ancestor of
HEAD (`merge-base --is-ancestor` exit 1).

**Step 6.2 — Backport complications**
Record: **Clean apply expected.** File structure matches upstream;
`crypto_engine_unregister_skciphers` API present; no conflicting changes
to this file since merge.

**Step 6.3 — Related fixes already present?**
Record: **No.** `omap_aes_unregister_algs` also absent from HEAD. No
grep match for `omap_des_unregister_algs`.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

**Step 7.1 — Subsystem**
Record: `drivers/crypto/` — OMAP DES hardware crypto driver.
**Criticality: PERIPHERAL** (legacy OMAP2+ embedded platforms).

**Step 7.2 — Activity**
Record: Low churn in this tree for `omap-des.c` (single merge commit
visible); mature legacy driver.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

**Step 8.1 — Who is affected**
Record: Users of OMAP DES hardware acceleration
(`CONFIG_CRYPTO_DEV_OMAP_DES`) who rebind the driver or re-probe after a
failed registration within the same module lifetime.

**Step 8.2 — Trigger conditions**
Record:
- Uncommon in production (typically probe-once-at-boot)
- More likely during development/testing (driver unbind/rebind)
- Requires root for sysfs driver unbind
- **Likelihood:** Low; **consequence if triggered:** High

**Step 8.3 — Failure mode severity**
Record:
- Stale `registered` counter after first remove/re-probe cycle
- Second remove: out-of-bounds reads of `algs_list[j]` for `j >= 4`
- Possible `WARN` from `crypto_unregister_alg()` for bogus entries
- **Severity: HIGH** (memory safety / undefined behavior), though
  trigger is rare

**Step 8.4 — Risk-benefit**
Record:
- **Benefit:** Medium — prevents latent OOB/WARN on driver lifecycle
  edge cases
- **Risk:** Very low — 16-line helper, behavior-preserving unregister
  with added counter reset
- **Ratio:** Favorable for stable

---

## PHASE 9: FINAL SYNTHESIS

**Step 9.1 — Evidence summary**

**FOR backport:**
- Fixes real stale-counter bug in static driver state
- Can cause out-of-bounds array access on driver rebind (verified by
  tracing `registered` vs `ARRAY_SIZE(algs_ecb_cbc)` = 4)
- Small, contained, maintainer-reviewed
- Applies cleanly to 6.18.43; required API exists
- omap-des lacks omap-aes’s `if (!registered)` mitigation

**AGAINST backport:**
- Commit message frames as refactor, not explicit bug report
- OMAP DES is legacy embedded hardware with small user base
- Trigger (driver rebind without module unload) is uncommon
- No syzbot/user reports
- Single probe+remove per boot works correctly (counter stale but
  unused)

**Unresolved:** Full lore review thread content; no independent runtime
test evidence.

**Step 9.2 — Stable rules checklist**
1. Obviously correct and tested? **PASS** — logic is clear; Herbert Xu
   sign-off; no Tested-by
2. Fixes real bug affecting users? **PASS** — stale counter → OOB on
   rebind
3. Important issue? **PASS** — memory safety / WARN (HIGH severity, low
   frequency)
4. Small and contained? **PASS** — ~26 lines, one file
5. No new features/APIs? **PASS** — internal helper only
6. Can apply to local tree? **PASS** — code and APIs present; not yet in
   HEAD

**Step 9.3 — Exception category**
Record: N/A (not device ID, quirk, DT, build fix, or docs).

**Step 9.4 — Decision rationale**
This is a disguised correctness fix. The unregister loops were
functionally equivalent for a single probe/remove cycle, but the missing
`registered = 0` reset leaves static driver state corrupted across
rebind cycles, eventually causing out-of-bounds access in the remove
path. The fix is minimal, self-contained, and matches established
patterns in other crypto drivers. While the trigger is uncommon on
legacy OMAP hardware, the consequence (OOB access) meets stable backport
criteria for driver lifecycle correctness fixes.

---

## Verification

- [Phase 1] Parsed commit message and tags from user-provided diff and
  `git show 9ab1392b1163`
- [Phase 2] Read `drivers/crypto/omap-des.c` lines 94–98, 796–801,
  1029–1084; counted 4 algorithms in `algs_ecb_cbc[]`
- [Phase 2] Read `crypto/crypto_engine.c:634-661` —
  `crypto_engine_unregister_skciphers` matches old loop semantics
- [Phase 2] Read `crypto/algapi.c:489-499` — `crypto_unregister_alg`
  WARN on unregistered algorithm
- [Phase 3] `git merge-base --is-ancestor 9ab1392b1163 HEAD` → exit 1
  (not in tree)
- [Phase 3] Series identified: patches 1/3 aes, 2/3 des, 3/3 scatterlist
  (independent)
- [Phase 4] `b4 dig -c 18e80df6bcd29` → lore URL found; `b4 dig -a` → v1
  series; `b4 dig -w` → maintainers CC’d
- [Phase 4] Lore/patch.msgid.link fetch blocked by Anubis — thread
  content UNVERIFIED
- [Phase 5] Compared `omap-aes.c:1184-1264` — has `if (!registered)`
  guard and decrement-on-remove; omap-des lacks both
- [Phase 6] `git describe HEAD` → v6.18.43; `make kernelversion` →
  6.18.43
- [Phase 6] `grep omap_des_unregister_algs` → no matches in tree (fix
  absent)
- [Phase 6] `grep crypto_engine_unregister_skciphers` → present in
  `crypto/crypto_engine.c`
- [Phase 8] Traced rebind scenario: probe(registered=4) → remove(unreg
  4, registered stays 4) → re-probe(registered→8) → remove(OOB j=7..4)

**YES**The backport analysis is complete: **YES** for Linux 6.18.43.

This commit fixes a real bug in `omap-des.c` where the static
`registered` counter is not reset after unregistering algorithms. On
driver rebind without module unload, that stale counter can grow past
the 4-entry `algs_list` array and cause out-of-bounds access on remove.
The fix is small, self-contained, and applies cleanly —
`crypto_engine_unregister_skciphers()` is already in this tree.

One background `git branch --contains` check was interrupted after
hanging on a large branch list; the important check was already done
separately: `git merge-base --is-ancestor` confirmed the fix is **not**
in current HEAD, while the buggy code is still present.

 drivers/crypto/omap-des.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
index 149ebd77710bf..16d5c617d5ee8 100644
--- a/drivers/crypto/omap-des.c
+++ b/drivers/crypto/omap-des.c
@@ -938,6 +938,20 @@ static int omap_des_get_pdev(struct omap_des_dev *dd,
 	return 0;
 }
 
+static void omap_des_unregister_algs(const struct omap_des_pdata *pdata)
+{
+	struct omap_des_algs_info *alg_info;
+	int i;
+
+	for (i = pdata->algs_info_size - 1; i >= 0; i--) {
+		alg_info = &pdata->algs_info[i];
+
+		crypto_engine_unregister_skciphers(alg_info->algs_list,
+						   alg_info->registered);
+		alg_info->registered = 0;
+	}
+}
+
 static int omap_des_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -1043,11 +1057,7 @@ static int omap_des_probe(struct platform_device *pdev)
 	return 0;
 
 err_algs:
-	for (i = dd->pdata->algs_info_size - 1; i >= 0; i--)
-		for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--)
-			crypto_engine_unregister_skcipher(
-					&dd->pdata->algs_info[i].algs_list[j]);
-
+	omap_des_unregister_algs(dd->pdata);
 err_engine:
 	if (dd->engine)
 		crypto_engine_exit(dd->engine);
@@ -1067,16 +1077,12 @@ static int omap_des_probe(struct platform_device *pdev)
 static void omap_des_remove(struct platform_device *pdev)
 {
 	struct omap_des_dev *dd = platform_get_drvdata(pdev);
-	int i, j;
 
 	spin_lock_bh(&list_lock);
 	list_del(&dd->list);
 	spin_unlock_bh(&list_lock);
 
-	for (i = dd->pdata->algs_info_size - 1; i >= 0; i--)
-		for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--)
-			crypto_engine_unregister_skcipher(
-					&dd->pdata->algs_info[i].algs_list[j]);
+	omap_des_unregister_algs(dd->pdata);
 
 	cancel_work_sync(&dd->done_task);
 	omap_des_dma_cleanup(dd);
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.15] crypto: ixp4xx - fix buffer chain unwind on allocation failure

[Sasha Levin]

From: Ruoyu Wang <ruoyuw560@gmail.com>

[ Upstream commit 25056329384010a8672552b134f609601dc4f80e ]

chainup_buffers() builds a linked list of buffer descriptors for a
scatterlist. If dma_pool_alloc() fails while constructing the list, the
current code sets buf to NULL and later dereferences it unconditionally
at the end of the function:

  buf->next = NULL;
  buf->phys_next = 0;

This can lead to a null-pointer dereference on allocation failure.

If the failure happens after part of the descriptor chain has already
been allocated and DMA-mapped, the partially constructed chain also
needs to be released.

Fix this by terminating the partially constructed chain on allocation
failure and letting the callers unwind it via their existing cleanup
paths. Also fix ablk_perform() to preserve the hook pointers before
checking for failure, so partially built chains can be freed correctly.

Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Acked-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

## Phase 1: Commit Message Forensics

**Step 1.1 — Subject line**

Record: `[crypto: ixp4xx] [fix] fix buffer chain unwind on allocation
failure in chainup_buffers()/ablk_perform()`

**Step 1.2 — Tags**

Record:
- `Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>` — author
- `Acked-by: Linus Walleij <linusw@kernel.org>` — ARM/platform
  maintainer ack
- `Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>` — crypto
  maintainer merge
- No `Fixes:` tag (expected for manual review)
- No `Reported-by:` / `Link:` / `Cc: stable@vger.kernel.org`
- Notable: maintainer ack from Linus Walleij; Herbert Xu applied v2 per
  lore

**Step 1.3 — Body analysis**

Record:
- **Bug:** `chainup_buffers()` on `dma_pool_alloc()` failure sets `buf =
  NULL`, breaks, then unconditionally does `buf->next = NULL` → NULL
  pointer dereference.
- **Secondary bug:** Partially built descriptor chains are not
  terminated/freed on failure.
- **Symptom:** Kernel oops on allocation failure; possible DMA-pool leak
  if the NULL deref were avoided without proper unwind.
- **Root cause:** Incorrect error handling in `chainup_buffers()`;
  `ablk_perform()` checks return value before saving hook pointers, so
  cleanup cannot free partial chains.
- **Version info:** None in commit message.

**Step 1.4 — Hidden bug fix?**

Record: No — this is an explicit bug fix (NULL deref + resource leak on
error path), not disguised cleanup.

---

## Phase 2: Diff Analysis

**Step 2.1 — Inventory**

Record:
- **File:** `drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c` (+14 / −11,
  ~25 lines)
- **Functions:** `chainup_buffers()`, `ablk_perform()`
- **Scope:** Single-file surgical fix

**Step 2.2 — Code flow changes**

Record:
- **Hunk 1 (`chainup_buffers`):** Before: on alloc failure, `buf = NULL;
  break;` then fall through to `buf->next = NULL` (crash). After:
  terminate current `buf` chain (`buf->next = NULL; buf->phys_next = 0`)
  and `return NULL` immediately.
- **Hunk 2 (`ablk_perform`):** Before: `if (!chainup_buffers(...)) goto
  cleanup` before saving `dst_hook`/`src_hook` into `req_ctx` and
  `crypt`. After: assign return to `buf`, always save hook pointers
  first, then `if (!buf) goto cleanup` — matching the pattern already
  used in `aead_perform()`.

**Step 2.3 — Bug mechanism**

Record:
- **Category:** NULL pointer dereference + error-path resource leak
- **Mechanism:** On `dma_pool_alloc()` failure, `buf` becomes NULL but
  is dereferenced at function end. Even if that were avoided,
  `ablk_perform()` would jump to cleanup without populating
  `req_ctx->dst/src` and `crypt->dst_buf/src_buf`, so `free_buf_chain()`
  would not release partially allocated chains.

**Step 2.4 — Fix quality**

Record: Fix is minimal, obviously correct, and aligns `ablk_perform()`
with the existing correct pattern in `aead_perform()`. Low regression
risk — only affects failure paths.

---

## Phase 3: Git History Investigation

**Step 3.1 — Blame**

Record: `git blame` on `chainup_buffers()` lines 872–902 attributes all
lines to `5d324e5159d9e` (Nov 28, 2025 merge). This checkout’s history
is shallow around this file; exact introduction commit of the buggy
pattern could not be determined here. The driver itself dates to 2008
per file header.

**Step 3.2 — Fixes: tag**

Record: N/A — no `Fixes:` tag present.

**Step 3.3 — Related file history**

Record: `git log --oneline -20 --
drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c` shows only the merge commit
in this tree. Fix commit is **not** present (`git log --grep="buffer
chain"` returns nothing). Buggy code confirmed at lines 886–900 and
1028–1040.

**Step 3.4 — Author context**

Record: No prior Ruoyu Wang commits in this tree’s
`drivers/crypto/intel/ixp4xx/` history. Patch was reviewed by crypto
maintainer Herbert Xu (v2 incorporated his feedback).

**Step 3.5 — Dependencies**

Record: Standalone fix; no series dependencies. `aead_perform()` in the
same file already uses the post-fix calling convention, confirming the
API contract.

---

## Phase 4: Mailing List and External Research

**Step 4.1 — Original discussion**

Record: Patch v2 submitted Apr 23, 2026 to linux-crypto. Thread:
https://lists.openwall.net/linux-kernel/2026/04/23/864. v2 changes per
Herbert Xu: keep unwind in callers, terminate partial chain, save hook
pointers in `ablk_perform()`. Herbert Xu replied “Patch applied.
Thanks.” (May 5, 2026).

**Step 4.2 — Reviewers**

Record: To: Herbert Xu, Corentin Labbe, linux-crypto. Cc: Linus Walleij,
Imre Kaloz, David S. Miller, linux-arm-kernel, linux-kernel. Appropriate
maintainers were included.

**Step 4.3 — Bug report**

Record: No external bug report or syzbot report. Bug identified by code
review / author analysis.

**Step 4.4 — Series context**

Record: v1 used internal `free_buf_chain()` in `chainup_buffers()`; v2
(committed version) moved unwind to callers per maintainer feedback.
Committed version is the latest revision.

**Step 4.5 — Stable list discussion**

Record: No stable-list discussion found. Absence of `Cc: stable` is not
a negative signal per review guidelines.

---

## Phase 5: Code Semantic Analysis

**Step 5.1 — Key functions**

Record: `chainup_buffers()`, `ablk_perform()`, `free_buf_chain()`

**Step 5.2 — Callers**

Record: `chainup_buffers()` called from:
- `ablk_perform()` (lines 1028, 1038) — **buggy caller pattern**
- `aead_perform()` (lines 1140, 1160) — **already correct pattern**

`ablk_perform()` called from `ablk_encrypt()`, `ablk_decrypt()`,
`ablk_rfc3686_crypt()`.

**Step 5.3 — Callees**

Record: `dma_pool_alloc()`, `dma_map_single()`, `sg_virt()`,
`sg_next()`, `free_buf_chain()` (on error paths)

**Step 5.4 — Reachability**

Record: Reachable from userspace crypto operations (skcipher
encrypt/decrypt) on systems with `CONFIG_CRYPTO_DEV_IXP4XX` and IXP4xx
hardware (`ARCH_IXP4XX`). Trigger requires `dma_pool_alloc()` failure
(memory pressure or pool exhaustion), most likely under `GFP_ATOMIC`
when `CRYPTO_TFM_REQ_MAY_SLEEP` is unset.

**Step 5.5 — Similar patterns**

Record: `aead_perform()` already implements the correct post-fix
pattern, demonstrating this is the intended API usage and
`ablk_perform()` was simply inconsistent.

---

## Phase 6: Cross-Reference Against Local Tree (6.18.43)

**Step 6.1 — Buggy code present?**

Record: **YES.** Local tree is `6.18.43` (`git describe`:
`v6.18.43-1-gc7f0dac02d232`). Buggy code at:

```886:901:drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c
                if (!next_buf) {
                        buf = NULL;
                        break;
                }
                // ...
        buf->next = NULL;
        buf->phys_next = 0;
        return buf;
```

and buggy `ablk_perform()` caller pattern at lines 1028–1040. Fix is
**not** yet applied.

**Step 6.2 — Backport complications**

Record: Expected **clean apply** — current source matches the patch’s
`index fcc0cf4df..5b90cf0fb` base context exactly.

**Step 6.3 — Related fixes already present?**

Record: No equivalent fix found via `git log --grep`. `aead_perform()`
already has correct hook-pointer handling but does not fix the
`chainup_buffers()` NULL deref.

---

## Phase 7: Subsystem and Maintainer Context

**Step 7.1 — Subsystem**

Record: `drivers/crypto/intel/ixp4xx/` — crypto hardware driver for
Intel IXP4xx NPE. **Criticality: PERIPHERAL** (platform-specific
embedded hardware), but error path is in common crypto request handling.

**Step 7.2 — Activity**

Record: `drivers/crypto/` has active maintenance in this tree (recent
qat, tegra, cavium fixes). IXP4xx driver file shows limited recent churn
in this checkout.

---

## Phase 8: Impact and Risk Assessment

**Step 8.1 — Who is affected**

Record: Systems with `CONFIG_CRYPTO_DEV_IXP4XX` (depends on `ARCH_IXP4XX
|| COMPILE_TEST`, plus `IXP4XX_QMGR` and `IXP4XX_NPE`). Primarily
embedded IXP4xx/ARM routers and similar devices using hardware crypto
acceleration.

**Step 8.2 — Trigger conditions**

Record: Skcipher crypto request through `ablk_perform()` when
`dma_pool_alloc()` fails mid-chain. Uncommon but realistic under memory
pressure. Userspace can initiate crypto ops; failure is not theoretical
once pool is exhausted.

**Step 8.3 — Failure mode severity**

Record:
- **Primary:** NULL pointer dereference → kernel oops (**CRITICAL** when
  triggered)
- **Secondary:** Partial buffer-chain leak on alloc failure without
  proper hook setup (**HIGH** — DMA pool exhaustion)

**Step 8.4 — Risk vs benefit**

Record:
- **Benefit:** Prevents kernel crash and fixes error-path resource leak
  in hardware crypto path
- **Risk:** Very low — ~25 lines, failure-path only, matches existing
  `aead_perform()` pattern, maintainer-reviewed
- **Ratio:** Clear benefit outweighs risk for this tree

---

## Phase 9: Final Synthesis

**Step 9.1 — Evidence summary**

**FOR backport:**
- Real, verifiable NULL deref on error path
- Secondary resource-leak fix in `ablk_perform()`
- Small, surgical, single-file change
- Acked by Linus Walleij; applied by crypto maintainer Herbert Xu after
  review
- Buggy code confirmed present in local 6.18.43 tree; fix not yet
  applied
- Patch should apply cleanly
- Same-file `aead_perform()` validates the fix approach

**AGAINST backport:**
- Niche hardware (IXP4xx only) — smaller user base
- Requires `dma_pool_alloc()` failure — not everyday, but real under
  pressure
- No syzbot/user crash report (found via review)

**Unresolved:** Exact commit that introduced the buggy `buf = NULL;
break` pattern could not be determined from this tree’s shallow file
history.

**Step 9.2 — Stable rules checklist**

1. Obviously correct and tested? **PASS** — logic is clear; maintainer
   reviewed and applied v2
2. Fixes a real bug? **PASS** — NULL deref + leak on alloc failure
3. Important issue? **PASS** — kernel oops (CRITICAL when triggered);
   memory leak (HIGH)
4. Small and contained? **PASS** — 1 file, ~25 lines, failure paths only
5. No new features/APIs? **PASS** — error-handling fix only
6. Can apply to local tree? **PASS** — buggy code present; clean apply
   expected

**Step 9.3 — Exception categories**

Record: None (not device ID, quirk, DT, build, or docs). Standard bug-
fix backport.

**Step 9.4 — Decision rationale**

For Linux **6.18.43**, this commit fixes a confirmed NULL pointer
dereference and an associated error-path resource leak in an existing
driver that is present and buggy in this tree. The fix is small,
maintainer-reviewed, and follows an established pattern already used in
the same file. While the hardware is niche, stable trees routinely
accept driver crash fixes of this nature.

---

## Verification

- [Phase 1] Parsed subject, tags, and body from provided commit message
  and openwall lore thread
- [Phase 1] Confirmed Acked-by: Linus Walleij; Herbert Xu merge SOB
- [Phase 2] Read current `chainup_buffers()` at lines 886–901: confirmed
  `buf = NULL; break` followed by `buf->next = NULL` (NULL deref)
- [Phase 2] Read current `ablk_perform()` at lines 1028–1040: confirmed
  hook pointers saved after failure check
- [Phase 2] Read `aead_perform()` at lines 1140–1166: confirmed correct
  post-fix pattern already present
- [Phase 2] Read `free_buf_chain()` at lines 333–347: confirmed cleanup
  depends on valid hook pointers
- [Phase 3] `git describe HEAD` → `v6.18.43-1-gc7f0dac02d232`; `make
  kernelversion` → `6.18.43`
- [Phase 3] `git blame -L 872,902` → buggy lines present (attrib.
  limited by tree history)
- [Phase 3] `git log --grep="buffer chain"` → no fix commit in tree
- [Phase 4] Fetched https://lists.openwall.net/linux-
  kernel/2026/04/23/864 — v2 patch content and maintainer apply
  confirmed
- [Phase 4] UNVERIFIED: `b4 dig -c <hash>` — fix commit hash not in
  local tree
- [Phase 5] `grep chainup_buffers` — 3 call sites: 2 in `ablk_perform`,
  2 in `aead_perform`
- [Phase 6] Confirmed driver exists:
  `drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c`
- [Phase 6] Read Kconfig: `CONFIG_CRYPTO_DEV_IXP4XX` depends on
  `ARCH_IXP4XX || COMPILE_TEST`
- [Phase 6] Patch base context matches current file (lines 886–889,
  1028–1040 identical to diff)
- [Phase 8] Failure mode: NULL deref → kernel oops; partial chain leak
  without `ablk_perform()` fix

**YES**

 drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c | 25 ++++++++++++---------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c b/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c
index fcc0cf4df637d..5b90cf0fb0e41 100644
--- a/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c
+++ b/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c
@@ -884,8 +884,9 @@ static struct buffer_desc *chainup_buffers(struct device *dev,
 		ptr = sg_virt(sg);
 		next_buf = dma_pool_alloc(buffer_pool, flags, &next_buf_phys);
 		if (!next_buf) {
-			buf = NULL;
-			break;
+			buf->next = NULL;
+			buf->phys_next = 0;
+			return NULL;
 		}
 		sg_dma_address(sg) = dma_map_single(dev, ptr, len, dir);
 		buf->next = next_buf;
@@ -983,7 +984,7 @@ static int ablk_perform(struct skcipher_request *req, int encrypt)
 	unsigned int nbytes = req->cryptlen;
 	enum dma_data_direction src_direction = DMA_BIDIRECTIONAL;
 	struct ablk_ctx *req_ctx = skcipher_request_ctx(req);
-	struct buffer_desc src_hook;
+	struct buffer_desc *buf, src_hook;
 	struct device *dev = &pdev->dev;
 	unsigned int offset;
 	gfp_t flags = req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ?
@@ -1025,22 +1026,24 @@ static int ablk_perform(struct skcipher_request *req, int encrypt)
 		/* This was never tested by Intel
 		 * for more than one dst buffer, I think. */
 		req_ctx->dst = NULL;
-		if (!chainup_buffers(dev, req->dst, nbytes, &dst_hook,
-				     flags, DMA_FROM_DEVICE))
-			goto free_buf_dest;
-		src_direction = DMA_TO_DEVICE;
+		buf = chainup_buffers(dev, req->dst, nbytes, &dst_hook,
+				      flags, DMA_FROM_DEVICE);
 		req_ctx->dst = dst_hook.next;
 		crypt->dst_buf = dst_hook.phys_next;
+		if (!buf)
+			goto free_buf_dest;
+		src_direction = DMA_TO_DEVICE;
 	} else {
 		req_ctx->dst = NULL;
 	}
 	req_ctx->src = NULL;
-	if (!chainup_buffers(dev, req->src, nbytes, &src_hook, flags,
-			     src_direction))
-		goto free_buf_src;
-
+	buf = chainup_buffers(dev, req->src, nbytes, &src_hook, flags,
+			      src_direction);
 	req_ctx->src = src_hook.next;
 	crypt->src_buf = src_hook.phys_next;
+	if (!buf)
+		goto free_buf_src;
+
 	crypt->ctl_flags |= CTL_FLAG_PERFORM_ABLK;
 	qmgr_put_entry(send_qid, crypt_virt2phys(crypt));
 	BUG_ON(qmgr_stat_overflow(send_qid));
-- 
2.53.0

[PATCH AUTOSEL 6.18] crypto: amcc - convert irq_of_parse_and_map to platform_get_irq

[Sasha Levin]

From: Rosen Penev <rosenp@gmail.com>

[ Upstream commit 1cecde1005399eb4e4069c036dcfcbe3c240b6e0 ]

Replace the deprecated irq_of_parse_and_map() call with the modern
platform_get_irq() in the probe function. This also improves error
handling: platform_get_irq() returns a negative errno on failure,
whereas irq_of_parse_and_map() returned 0.

Change the irq field in struct crypto4xx_core_device from u32 to int
to match the return type of platform_get_irq().

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: `crypto: amcc - convert irq_of_parse_and_map
to platform_get_irq`

**Local tree:** `stable/linux-6.18.y` at `v6.18.44-1-g2736c32da98b9`
(kernel version **6.18.44**)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: PARSE THE SUBJECT LINE
**Record:** `[crypto: amcc]` `[convert]` — Replace deprecated
`irq_of_parse_and_map()` with `platform_get_irq()` in the AMCC PPC4xx
crypto driver probe path.

### Step 1.2: PARSE ALL COMMIT MESSAGE TAGS
**Record:**
- **Fixes:** — absent (expected for candidate review)
- **Reported-by:** — none
- **Tested-by:** — none
- **Reviewed-by:** — none
- **Acked-by:** — none
- **Link:** — none
- **Cc: stable@vger.kernel.org** — absent (expected)
- **Signed-off-by:** Rosen Penev `<rosenp@gmail.com>`, Herbert Xu
  `<herbert@gondor.apana.org.au>`
- **Assisted-by:** opencode:big-pickle
- **Notable patterns:** No fuzzer report, no user bug report, no
  explicit stable nomination. Herbert Xu (crypto maintainer) signed off.

### Step 1.3: ANALYZE THE COMMIT BODY TEXT
**Record:**
- **Bug described:** `irq_of_parse_and_map()` returns `0` on failure,
  which is ambiguous and not a proper errno. `platform_get_irq()`
  returns a negative errno on failure.
- **Symptom/failure mode:** IRQ lookup failure is not detected before
  `devm_request_irq()`; `-EPROBE_DEFER` from the OF IRQ path is
  swallowed (converted to `0` by `irq_of_parse_and_map()`).
- **Version information:** None stated.
- **Root cause:** Deprecated IRQ API with incorrect failure signaling;
  missing explicit error check before IRQ registration.

### Step 1.4: DETECT HIDDEN BUG FIXES
**Record:** **Yes — hidden bug fix disguised as API modernization.**
Beyond deprecation cleanup, it fixes:
1. Missing probe error handling for IRQ lookup failure.
2. Failure to propagate `-EPROBE_DEFER` (verified: `of_irq_get()`
   returns `-EPROBE_DEFER` when `irq_find_host()` fails;
   `irq_of_parse_and_map()` maps `of_irq_parse_one()` errors to `0`).
3. Aligns with the same class of fix already backported to this tree for
   another PPC 460-class driver (`sata_dwc_460ex`).

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: INVENTORY THE CHANGES
**Record:**
- `drivers/crypto/amcc/crypto4xx_core.c`: +4 lines (error check added)
- `drivers/crypto/amcc/crypto4xx_core.h`: 1 line (`u32 irq` → `int irq`)
- **Functions modified:** `crypto4xx_probe()`
- **Scope:** Single-subsystem, surgical, 2 files, 6 insertions / 2
  deletions

### Step 2.2: UNDERSTAND THE CODE FLOW CHANGE
**Record:**
- **Hunk 1 (probe):** Before: assign IRQ via `irq_of_parse_and_map()`,
  proceed directly to `devm_request_irq()`. After: obtain IRQ via
  `platform_get_irq()`, bail out with proper errno (including
  `-EPROBE_DEFER`) if `< 0`, then request IRQ.
- **Hunk 2 (header):** Before: `irq` stored as `u32`. After: `int` to
  correctly hold negative errno values during assignment and positive
  IRQ numbers on success.
- **Path affected:** Platform driver probe, IRQ setup — initialization
  path on `CONFIG_CRYPTO_DEV_PPC4XX` hardware.

### Step 2.3: IDENTIFY THE BUG MECHANISM
**Record:**
- **Bug category:** Logic/correctness fix + initialization/probe-
  deferral fix
- **Mechanism:** `irq_of_parse_and_map()` returns `0` on
  `of_irq_parse_one()` failure (see `drivers/of/irq.c:44-45`),
  conflating failure with a potentially valid IRQ number and never
  returning `-EPROBE_DEFER`. The old code then called
  `devm_request_irq()` with `0`, which returns `-EINVAL` via
  `irq_to_desc(0)` returning NULL — causing permanent probe failure
  instead of deferred reprobe. `platform_get_irq()` → `of_irq_get()`
  correctly returns negative errnos including `-EPROBE_DEFER`.

### Step 2.4: ASSESS THE FIX QUALITY
**Record:**
- Fix is minimal, idiomatic, and matches kernel-wide pattern (documented
  in `platform_get_irq()` kerneldoc).
- `core_dev->irq` is only referenced at assignment and
  `devm_request_irq()` call — `u32`→`int` change is safe.
- **Regression risk:** Very low. Same author applied an analogous change
  to `net: ibm: emac` already present in this stable tree.
- **Minor concern:** On `-EPROBE_DEFER`, `err_iomap` path runs
  `tasklet_kill()` and manual pool teardown before returning —
  acceptable since probe will retry from scratch.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: BLAME THE CHANGED LINES
**Record:**
- `irq_of_parse_and_map()` line introduced in `b0a191cebea13c`
  (Christian Lamparter, 2017-12-22).
- `devm_request_irq()` conversion in `0a53948477ca1d` (Rosen Penev,
  2024-10-10).
- Buggy IRQ pattern has been present since 2017; devm conversion in 2024
  did not fix the error-handling gap.

### Step 3.2: FOLLOW THE FIXES: TAG
**Record:** No `Fixes:` tag present — not applicable.

### Step 3.3: CHECK FILE HISTORY FOR RELATED CHANGES
**Record:**
- Related stable precedent: `678d874e6ae11` (`ata: sata_dwc_460ex: use
  platform_get_irq()`) — same author (Rosen Penev), same PPC 4xx
  platform family, same API migration, explicitly backported to
  `stable/linux-6.18.y` with rationale citing missing
  `irq_dispose_mapping()` and better error reporting.
- Related author commit: `a598f66d91693` (`net: ibm: emac: use
  platform_get_irq`) — same author, backported to this tree.
- `bdd3f7fa77257` (2012): moved `err_iomap` label to cover
  post-`irq_of_parse_and_map` cleanup — shows IRQ setup has long been in
  this code region.
- **Standalone:** Single-patch fix, not part of a series.

### Step 3.4: CHECK THE AUTHOR'S OTHER COMMITS
**Record:** Rosen Penev is an active contributor to this driver
(`0a53948477ca1d` devm probe refactor, `7337b18f1ec75` resource
cleanup). Same author has had similar IRQ API migrations accepted into
this stable tree.

### Step 3.5: CHECK FOR DEPENDENT/PREREQUISITE COMMITS
**Record:** No dependencies. Commit `1cecde1005399` applies cleanly to
current `6.18.44` tree (`git apply --check` succeeded). Standalone.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: FIND THE ORIGINAL PATCH DISCUSSION
**Record:**
- `b4 dig -c 1cecde1005399`:
  https://patch.msgid.link/20260602014645.522137-1-rosenp@gmail.com
- **Series revisions:** v1 only (`b4 dig -a`)
- **Lore content:** Could not fetch full thread (Anubis bot protection
  on lore.kernel.org). No reviewer stable nominations verifiable from
  fetched content.

### Step 4.2: CHECK WHO REVIEWED THE PATCH
**Record:** `b4 dig -w` recipients: Rosen Penev, `linux-
crypto@vger.kernel.org`, Herbert Xu, David S. Miller, `linux-
kernel@vger.kernel.org`. Herbert Xu (crypto maintainer) committed it. No
explicit Reviewed-by in commit.

### Step 4.3: SEARCH FOR THE BUG REPORT
**Record:** No bug report, syzbot link, or user-reported crash. Bug
identified by code inspection / API deprecation work.

### Step 4.4: CHECK FOR RELATED PATCHES AND SERIES
**Record:** Standalone patch. Related stable backport `678d874e6ae11`
(sata_dwc_460ex, PPC 460ex) provides direct precedent in this same
stable tree.

### Step 4.5: CHECK STABLE MAILING LIST HISTORY
**Record:** Not searched on lore stable list (fetch blocked). However,
`678d874e6ae11` and `a598f66d91693` in `git log stable/linux-6.18.y`
confirm stable maintainers accept this class of fix for PPC platform
drivers.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: IDENTIFY KEY FUNCTIONS IN THE DIFF
**Record:** `crypto4xx_probe()` — only function modified.

### Step 5.2: TRACE CALLERS
**Record:** `crypto4xx_probe()` is the `.probe` callback of the
`platform_driver` for `CONFIG_CRYPTO_DEV_PPC4XX`. Called during kernel
boot / module load when a matching OF platform device is registered on
PowerPC 4xx SoCs. Not a hot path; runs once per device at
initialization.

### Step 5.3: TRACE CALLEES
**Record:** Key callees in affected region: `platform_get_irq()` →
`of_irq_get()`, `devm_request_irq()`, `tasklet_init()`,
`devm_platform_ioremap_resource()`, pool build functions. IRQ path
involves OF parsing and interrupt domain mapping.

### Step 5.4: FOLLOW THE CALL CHAIN
**Record:** Device tree match → `platform_device` registration →
`crypto4xx_probe()` → IRQ setup → `devm_request_irq()`. Reachable on
every boot for systems with `CRYPTO_DEV_PPC4XX=y/m` and matching
hardware (e.g., AMCC PPC4xx crypto accelerator on embedded PowerPC
boards).

### Step 5.5: SEARCH FOR SIMILAR PATTERNS
**Record:** Same `irq_of_parse_and_map` → `platform_get_irq` migration
pattern backported in this tree for `sata_dwc_460ex` and `ibm emac`. No
`irq_dispose_mapping()` anywhere in `drivers/crypto/amcc/` (verified via
grep) — same cleanup gap cited in the sata stable backport.

---

## PHASE 6: CROSS-REFERENCING AGAINST THE LOCAL TREE

### Step 6.1: DOES THE BUGGY CODE EXIST IN THIS TREE?
**Record:** **Yes.** At `drivers/crypto/amcc/crypto4xx_core.c:1298`:
```c
core_dev->irq = irq_of_parse_and_map(ofdev->dev.of_node, 0);
```
No error check before `devm_request_irq()`. `struct
crypto4xx_core_device::irq` is still `u32` in `crypto4xx_core.h:109`.
Bug present since 2017.

### Step 6.2: CHECK FOR BACKPORT COMPLICATIONS
**Record:** **Clean apply expected.** `git format-patch -1 1cecde1005399
| git apply --check` succeeded with no conflicts. File structure matches
upstream commit base.

### Step 6.3: CHECK IF RELATED FIXES ARE ALREADY HERE
**Record:** Fix `1cecde1005399` is **not** in this tree. `git log
stable/linux-6.18.y..1cecde1005399 -- drivers/crypto/amcc/` shows only
this commit as relevant. No duplicate fix present.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: IDENTIFY THE SUBSYSTEM AND ITS CRITICALITY
**Record:** `drivers/crypto/amcc/` — crypto hardware accelerator driver.
**Criticality: PERIPHERAL** (platform-specific; `depends on PPC &&
4xx`). Affects crypto offload and optionally HW RNG on embedded PowerPC
4xx systems.

### Step 7.2: ASSESS SUBSYSTEM ACTIVITY
**Record:** Moderately active — recent stable commits include ahash
removal, gcc12 warning fix, devm conversion (2024). Driver is mature but
still maintained.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: DETERMINE WHO IS AFFECTED
**Record:** **Platform-specific / config-specific** — users of
`CONFIG_CRYPTO_DEV_PPC4XX` on PowerPC 4xx SoCs (embedded systems, some
legacy networking appliances). Small population, but real hardware.

### Step 8.2: DETERMINE THE TRIGGER CONDITIONS
**Record:**
- IRQ not yet available in device tree / interrupt parent not probed yet
  → `-EPROBE_DEFER` mishandled.
- Malformed or missing interrupt spec → `0` returned, probe fails at
  `request_irq()` with `-EINVAL` instead of clean early error.
- **Likelihood:** Boot-order race is realistic on deferred-probe
  systems; missing IRQ spec is a DT configuration error.
- **Unprivileged trigger:** No — requires specific hardware and kernel
  config.

### Step 8.3: DETERMINE THE FAILURE MODE SEVERITY
**Record:**
- **Without fix:** Driver probe fails permanently (returns `-EINVAL`
  instead of `-EPROBE_DEFER`), or proceeds with invalid IRQ `0`. Crypto
  hardware acceleration unavailable; possible mis-registered interrupt
  in edge cases.
- **Severity: MEDIUM** — functional failure (hardware crypto offload
  broken), not a system-wide crash, data corruption, or security
  vulnerability. Important for affected embedded deployments.

### Step 8.4: CALCULATE RISK-BENEFIT RATIO
**Record:**
- **Benefit:** MEDIUM for PPC 4xx users — restores correct probe
  deferral and proper IRQ error handling; aligns with already-accepted
  stable precedent.
- **Risk:** VERY LOW — 6-line change, applies cleanly, no API changes,
  no behavior change on success path.
- **Ratio:** Favorable for backport, especially given identical fix
  already in this tree for `sata_dwc_460ex`.

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: COMPILE THE EVIDENCE

**FOR backporting:**
- Real probe bug: `-EPROBE_DEFER` not propagated through
  `irq_of_parse_and_map()`
- Missing explicit IRQ error check before `devm_request_irq()`
- Small, surgical, obviously correct fix
- Applies cleanly to 6.18.44
- Direct stable precedent: `678d874e6ae11` (same author, same PPC 4xx
  family, same fix class) already in this tree
- Same author's `a598f66d91693` (emac) also in this tree
- Herbert Xu signed off
- Buggy code confirmed present in local tree since 2017

**AGAINST backporting:**
- No user bug report or syzbot finding
- Affects niche embedded hardware only
- Failure mode is driver probe failure, not kernel crash/oops/corruption
- Primarily described as API modernization

**UNRESOLVED:**
- Full lore review thread inaccessible (bot protection)
- No explicit stable nomination in mailing list (unverifiable)

### Step 9.2: STABLE RULES CHECKLIST
1. Obviously correct and tested? **PASS** — idiomatic
   `platform_get_irq()` pattern; no Tested-by on this specific commit,
   but analogous change tested in related work.
2. Fixes a real bug? **PASS** — EPROBE_DEFER mishandling and missing IRQ
   error check verified in source.
3. Important issue? **PASS (borderline)** — permanent probe failure on
   affected hardware; not crash/corruption but functionally important
   for PPC 4xx crypto users.
4. Small and contained? **PASS** — 6 lines across 2 files.
5. No new features or APIs? **PASS** — uses existing
   `platform_get_irq()` API.
6. Can apply to local tree? **PASS** — verified clean apply.

### Step 9.3: EXCEPTION CATEGORIES
**Record:** Not a device ID, quirk, DT, build, or documentation fix.
Qualifies as a probe correctness fix.

### Step 9.4: DECISION RATIONALE

This commit fixes a genuine probe-path bug on hardware that exists in
the 6.18.y tree (`CONFIG_CRYPTO_DEV_PPC4XX`, `PPC && 4xx`). The failure
to propagate `-EPROBE_DEFER` can cause the crypto accelerator driver to
fail permanently at boot when the interrupt parent has not yet probed —
a real functional regression on affected embedded systems. The fix is
minimal, low-risk, and follows the exact pattern already accepted for
stable backport in this same tree (`ata: sata_dwc_460ex: use
platform_get_irq()` by the same author on the same platform family).
While the user population is small, stable trees explicitly serve
embedded/LTS deployments where this hardware lives.

---

## Verification

- **[Phase 1]** Parsed commit `1cecde1005399`: subject, tags, body
  analyzed; no Reported-by/syzbot/Fixes tags.
- **[Phase 2]** Diff analyzed: 2 files, `crypto4xx_probe()` only; error-
  check and type change verified.
- **[Phase 2]** Read `drivers/of/irq.c:39-50`: `irq_of_parse_and_map()`
  returns `0` on `of_irq_parse_one()` failure.
- **[Phase 2]** Read `drivers/of/irq.c:458-478`: `of_irq_get()` returns
  `-EPROBE_DEFER` when `irq_find_host()` fails.
- **[Phase 2]** Read `kernel/irq/manage.c:2106-2108`: `request_irq()`
  returns `-EINVAL` when `irq_to_desc(irq)` is NULL.
- **[Phase 3]** `git blame`: `irq_of_parse_and_map` from 2017
  (`b0a191cebea13c`).
- **[Phase 3]** `git log stable/linux-6.18.y`: found precedent commits
  `678d874e6ae11`, `a598f66d91693`.
- **[Phase 3]** `git show 678d874e6ae11`: sata_dwc_460ex stable backport
  with same rationale.
- **[Phase 3]** `git show a598f66d91693`: emac stable backport by same
  author.
- **[Phase 3]** `git apply --check`: patch applies cleanly to current
  tree.
- **[Phase 4]** `b4 dig -c 1cecde1005399`: found lore URL; v1 only;
  recipients include Herbert Xu.
- **[Phase 4]** WebFetch lore URL: blocked by Anubis — full thread
  unverified.
- **[Phase 5]** `grep core_dev->irq drivers/crypto/amcc/`: only used in
  probe assignment and `devm_request_irq()`.
- **[Phase 5]** Read `drivers/base/platform.c:260-270`:
  `platform_get_irq()` behavior confirmed.
- **[Phase 6]** `git describe HEAD`: v6.18.44 on `stable/linux-6.18.y`.
- **[Phase 6]** Read current `crypto4xx_core.c:1297-1304`: buggy code
  confirmed present.
- **[Phase 6]** `git log stable/linux-6.18.y..1cecde1005399 --
  drivers/crypto/amcc/`: fix not yet present.
- **[Phase 7]** Read `drivers/crypto/Kconfig:294-306`:
  `CRYPTO_DEV_PPC4XX` depends on `PPC && 4xx`.
- **[Phase 8]** Assessed failure mode: permanent probe failure / missing
  crypto offload, severity MEDIUM.

**YES****Verdict: YES** — backport to this tree (`linux-6.18.y` /
6.18.44).

The commit fixes real probe-path bugs in the AMCC PPC4xx crypto driver:
`irq_of_parse_and_map()` returns `0` on failure (and swallows
`-EPROBE_DEFER`), so IRQ setup can fail permanently instead of
deferring. The fix is small (6 lines), applies cleanly, and matches the
same pattern already backported here for `sata_dwc_460ex` by the same
author.

**Scope:** Only affects `CONFIG_CRYPTO_DEV_PPC4XX` on PowerPC 4xx
embedded hardware — niche, but a genuine functional bug for those
systems.

 drivers/crypto/amcc/crypto4xx_core.c | 6 +++++-
 drivers/crypto/amcc/crypto4xx_core.h | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index be55eb6a03164..d82b00cdc4e08 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -1295,7 +1295,11 @@ static int crypto4xx_probe(struct platform_device *ofdev)
 	}
 
 	/* Register for Crypto isr, Crypto Engine IRQ */
-	core_dev->irq = irq_of_parse_and_map(ofdev->dev.of_node, 0);
+	core_dev->irq = platform_get_irq(ofdev, 0);
+	if (core_dev->irq < 0) {
+		rc = core_dev->irq;
+		goto err_iomap;
+	}
 	rc = devm_request_irq(&ofdev->dev, core_dev->irq,
 			      is_revb ? crypto4xx_ce_interrupt_handler_revb :
 					crypto4xx_ce_interrupt_handler,
diff --git a/drivers/crypto/amcc/crypto4xx_core.h b/drivers/crypto/amcc/crypto4xx_core.h
index 3a028aec3f0c1..66a95733c86dd 100644
--- a/drivers/crypto/amcc/crypto4xx_core.h
+++ b/drivers/crypto/amcc/crypto4xx_core.h
@@ -106,7 +106,7 @@ struct crypto4xx_core_device {
 	struct crypto4xx_device *dev;
 	struct hwrng *trng;
 	u32 int_status;
-	u32 irq;
+	int irq;
 	struct tasklet_struct tasklet;
 	spinlock_t lock;
 };
-- 
2.53.0

[PATCH AUTOSEL 6.18-6.12] crypto: atmel-sha204a - remove sysfs group before hwrng

[Sasha Levin]

From: Thorsten Blum <thorsten.blum@linux.dev>

[ Upstream commit d58b4a09d7f06750a706b70d068f5a678dad8233 ]

atmel_sha204a_probe() registers the hwrng before creating the sysfs
group. Mirror this order in atmel_sha204a_remove() by removing the sysfs
group before unregistering the hwrng.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

The background searches finished. The Herbert crypto tree is reachable,
and the upstream commit is **`d58b4a09d7f06`** (`crypto: atmel-sha204a -
remove sysfs group before hwrng`). It isn’t in the current **6.18.44**
ancestry — the buggy teardown order is still present in
`drivers/crypto/atmel-sha204a.c`.

That doesn’t change the earlier verdict: **YES** for backport to this
tree. It’s a one-line reorder that should keep the existing `kfree()`
(the LKML version also dropped it, which would be wrong here).

 drivers/crypto/atmel-sha204a.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/crypto/atmel-sha204a.c b/drivers/crypto/atmel-sha204a.c
index 8a3520c9a0ff5..2a37a4aeda92b 100644
--- a/drivers/crypto/atmel-sha204a.c
+++ b/drivers/crypto/atmel-sha204a.c
@@ -205,11 +205,10 @@ static void atmel_sha204a_remove(struct i2c_client *client)
 {
 	struct atmel_i2c_client_priv *i2c_priv = i2c_get_clientdata(client);
 
+	sysfs_remove_group(&client->dev.kobj, &atmel_sha204a_groups);
 	devm_hwrng_unregister(&client->dev, &i2c_priv->hwrng);
 	atmel_i2c_flush_queue();
 
-	sysfs_remove_group(&client->dev.kobj, &atmel_sha204a_groups);
-
 	kfree((void *)i2c_priv->hwrng.priv);
 }
 
-- 
2.53.0

[PATCH AUTOSEL 6.18] crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode

[Sasha Levin]

From: Ilya Dryomov <idryomov@gmail.com>

[ Upstream commit 6b7e97752854b1f7bccc41864428ea3b55c53cde ]

hmac(sha256), hmac(sha384) and cts(cbc(aes)) algorithms have been
marked as FIPS allowed for years.  Mark the respective authenc()
constructions per RFC 8009 ("AES Encryption with HMAC-SHA2 for
Kerberos 5") as such as well.

SP 800-57 Part 3 Rev. 1 from Jan 2015 [1] links the draft of what
became RFC 8009 in Oct 2016 as approved in section 6.3 Procurement
Guidance (item/recommendation 3).

[1] https://csrc.nist.gov/pubs/sp/800/57/pt3/r1/final

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

The background git searches finished and match what we already had:

- **Subject search** — No commit with “allow authenc” in this tree.
  Related hits are krb5/CTS/RFC 8009 work (`d1775a177f7f3`, SUNRPC RFC
  8009 KUnit tests, etc.).
- **Krb5 test vectors** — Added in `1b80b6f446ed2` (“crypto/krb5: Test
  manager data”), committed **2025-03-02**. That’s when the two
  `authenc(...,cts(cbc(aes)))` entries landed without `fips_allowed`.
- **Commit hash search** — Ilya Dryomov’s testmgr patch isn’t in 6.18.44
  yet; only his unrelated Ceph/RBD commits show up.

That supports the earlier **YES** verdict: the gap is in this tree, the
fix is a small metadata correction, and it unblocks RFC 8009 Kerberos
crypto in FIPS mode.

 crypto/testmgr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 6a490aaa71b9a..9a4d75782a486 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -4264,6 +4264,7 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.alg = "authenc(hmac(sha256),cts(cbc(aes)))",
 		.generic_driver = "authenc(hmac-sha256-lib,cts(cbc(aes-generic)))",
 		.test = alg_test_aead,
+		.fips_allowed = 1,
 		.suite = {
 			.aead = __VECS(krb5_test_aes128_cts_hmac_sha256_128)
 		}
@@ -4293,6 +4294,7 @@ static const struct alg_test_desc alg_test_descs[] = {
 		.alg = "authenc(hmac(sha384),cts(cbc(aes)))",
 		.generic_driver = "authenc(hmac-sha384-lib,cts(cbc(aes-generic)))",
 		.test = alg_test_aead,
+		.fips_allowed = 1,
 		.suite = {
 			.aead = __VECS(krb5_test_aes256_cts_hmac_sha384_192)
 		}
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] crypto: atmel-ecc - add support for atecc608b

[Sasha Levin]

From: Thorsten Blum <thorsten.blum@linux.dev>

[ Upstream commit b668edaf8dcc8d09f6f1e71797422b44d4bd22a3 ]

Tested on hardware with an ATECC608B at 0x60. The device binds
successfully, passes the driver's sanity check, and registers the
ecdh-nist-p256 KPP algorithm.

The hardware ECDH path was also exercised using a minimal KPP test
module, covering private key generation, public key derivation, and
shared secret computation.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: `crypto: atmel-ecc - add support for
atecc608b`

**Local tree:** Linux **6.18.43** (`v6.18.43-1-gc7f0dac02d232`, detached
from `stable/linux-6.18.y`)

**Upstream commit:** `b668edaf8dcc8d09f6f1e71797422b44d4bd22a3`
**Candidate commit:** `beb0043891b43` (not yet in current HEAD)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject Line
**Record:** `[crypto: atmel-ecc] [add] support for atecc608b` —
subsystem is the Atmel ECC crypto driver; verb is “add” (hardware
enablement, not a bug-fix verb).

### Step 1.2: Tags
**Record:**
| Tag | Value |
|-----|-------|
| Signed-off-by | Thorsten Blum `<thorsten.blum@linux.dev>` |
| Signed-off-by | Herbert Xu `<herbert@gondor.apana.org.au>` (crypto
maintainer) |
| Fixes: | **Absent** (expected for manual review) |
| Cc: stable | **Absent** (expected) |
| Reported-by: | **Absent** |
| Tested-by: | **Absent** (but commit body describes hardware testing) |
| Link: | **Absent** |

Notable: crypto maintainer Signed-off-by; no syzbot/sanitizer signals.

### Step 1.3: Body Analysis
**Record:**
- **Problem:** ATECC608B secure-element chips are not matched by the
  existing `atmel-ecc` driver; they will not bind/probe.
- **Symptom:** Device at I2C address 0x60 does not get a driver; ECDH
  offload unavailable.
- **Root cause:** Missing OF compatible (`atmel,atecc608b`) and I2C
  device ID (`atecc608b`) in match tables.
- **Verification:** Author tested binding, sanity check, and full ECDH
  KPP path on real hardware.

### Step 1.4: Hidden Bug Fix?
**Record:** **No.** This is explicit hardware enablement via device-ID
tables, not a disguised crash/leak/race fix. The driver logic is
unchanged; only match tables are extended.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory
**Record:**
| File | Changes |
|------|---------|
| `drivers/crypto/atmel-ecc.c` | +3 lines |

**Functions modified:** None (only static data tables
`atmel_ecc_dt_ids[]`, `atmel_ecc_id[]`).
**Scope:** Single-file, surgical device-ID addition.

### Step 2.2: Code Flow Change
**Record:**
- **Hunk 1 (OF table):** Before: only `atmel,atecc508a` matched. After:
  also `atmel,atecc608b`.
- **Hunk 2 (I2C ID table):** Before: only `"atecc508a"`. After: also
  `"atecc608b"`.
- **Affected path:** Device enumeration / driver probe only. No change
  to ECDH algorithm code, locking, or error handling.

### Step 2.3: Bug Mechanism
**Record:** **Category: Hardware device-ID addition (not a runtime bug
fix).** ATECC608B is protocol-compatible with the existing driver (same
sanity check, same NIST P-256 ECDH path) but was excluded from match
tables. Without these entries, the kernel never calls
`atmel_ecc_probe()` for this hardware.

### Step 2.4: Fix Quality
**Record:** Obviously correct — standard pattern mirroring the existing
`atecc508a` entry. Minimal risk; no new APIs, no logic changes.
Regression risk: **very low**.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:** Device-ID tables introduced in `5d324e5159d9e` (Merge tag
`usb-6.18-rc8`, Nov 2025) with only `atecc508a`. No “buggy code” — just
incomplete hardware coverage from initial driver landing.

### Step 3.2: Fixes: Tag
**Record:** **N/A** — no `Fixes:` tag present.

### Step 3.3: Related File History
**Record:** Recent `atmel-ecc.c` history in this tree:
- `9c032781c2b1f` — `crypto: atmel-ecc - Release client on allocation
  failure` (actual bug fix, already in tree)
- `5d324e5159d9e` — driver introduction via usb-6.18-rc8 merge

No prior atecc608b-related commits in HEAD. On `autosel` branch, later
cleanup commits exist (`006bbe8db4c35`, etc.) but are not prerequisites
for this 3-line ID addition.

### Step 3.4: Author Context
**Record:** Thorsten Blum submitted a 2-patch series. Herbert Xu replied
“All applied. Thanks.” Patch 2/2 (`dt-bindings: trivial-devices: add
atmel,atecc608b`) is a separate DT binding commit, not part of this
candidate.

### Step 3.5: Dependencies
**Record:** **Standalone.** No functional dependency on other commits.
Patch applies cleanly to current HEAD (`git apply --check` succeeded).
DT binding patch 2/2 is complementary for DT schema validation but not
required for the driver match tables themselves.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original Discussion
**Record:** `b4 dig -c beb0043891b43` found thread:
https://patch.msgid.link/20260412095642.120815-3-thorsten.blum@linux.dev

Series revisions: v1 (2026-03-30) and RESEND (2026-04-12). Committed
version matches RESEND.

### Step 4.2: Reviewers
**Record:** `b4 dig -w` CC'd Herbert Xu, David S. Miller, Nicolas Ferre
(Microchip), Alexandre Belloni, Claudiu Beznea, linux-crypto@, linux-
arm-kernel@, linux-kernel@. Herbert Xu applied the series.

### Step 4.3: Bug Reports
**Record:** **N/A** — no bug report links. Hardware validation described
in commit message.

### Step 4.4: Related Patches
**Record:** Part of `[PATCH RESEND 1/2]` series. Patch 2/2 adds
`atmel,atecc608b` to `Documentation/devicetree/bindings/trivial-
devices.yaml` (Acked-by: Rob Herring). That binding patch is separate;
this driver patch is self-contained.

### Step 4.5: Stable List History
**Record:** **Not searched** — no stable-specific discussion found in
the retrieved thread. Absence of `Cc: stable` is expected and not a
negative signal.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key Functions
**Record:** No functions modified. Match tables feed into
`atmel_ecc_driver` → `atmel_ecc_probe()` → `atmel_i2c_probe()` →
`device_sanity_check()`.

### Step 5.2: Callers
**Record:** `atmel_ecc_probe()` is invoked by the I2C core during device
enumeration when OF compatible or I2C device ID matches. Standard probe
path on embedded boards with secure elements.

### Step 5.3: Callees
**Record:** `atmel_i2c_probe()` performs I2C functionality check, clock
validation, and `device_sanity_check()` (verifies config/OTP zones are
locked). Chip-family-agnostic.

### Step 5.4: Reachability
**Record:** Triggered at boot when ATECC608B is present on I2C bus with
matching DT `compatible` or I2C board info. Common on embedded/IoT
platforms (similar boards already use `atmel,atecc508a` in this tree’s
DTS files).

### Step 5.5: Similar Patterns
**Record:** `atmel-sha204a.c` and other Atmel I2C crypto drivers use the
same pattern of multiple compatible strings in OF/I2C tables. ATECC508A
and ATECC608B share the same I2C command protocol for ECDH operations
supported by this driver.

---

## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE

### Step 6.1: Does Buggy Code Exist?
**Record:** The **driver exists** in 6.18.43
(`CONFIG_CRYPTO_DEV_ATMEL_ECC`, `drivers/crypto/atmel-ecc.c`). The
**missing device IDs** also exist as a gap — only `atecc508a` is listed;
`atecc608b` is absent. Driver introduced in 6.18 via `5d324e5159d9e`. No
`atecc608b` references anywhere in the tree.

### Step 6.2: Backport Complications
**Record:** **Clean apply** — `git apply --check` on the diff against
current HEAD succeeded with no conflicts.

### Step 6.3: Related Fixes Already Present?
**Record:** `9c032781c2b1f` (allocation-failure leak fix) is already in
tree. No duplicate atecc608b support found.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: Subsystem Criticality
**Record:** `drivers/crypto/` — **IMPORTANT** (hardware crypto offload
for embedded secure elements). Config-dependent
(`CONFIG_CRYPTO_DEV_ATMEL_ECC`).

### Step 7.2: Subsystem Activity
**Record:** Driver is new to 6.18 (landed Nov 2025). Low churn in this
tree since introduction (one bug-fix commit).

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who Is Affected
**Record:** Users of boards with **ATECC608B** secure elements on I2C,
using `CONFIG_CRYPTO_DEV_ATMEL_ECC=m/y`. Currently zero support for this
chip variant in 6.18.y.

### Step 8.2: Trigger Conditions
**Record:** ATECC608B present on I2C bus at boot. Not a security
vulnerability or crash trigger — hardware simply does not bind without
the ID.

### Step 8.3: Failure Mode Severity
**Record:** **LOW** for system stability (no crash/corruption).
**MEDIUM** for functionality — secure-element ECDH offload is completely
unavailable for ATECC608B users on 6.18.y without this patch.

### Step 8.4: Risk-Benefit
**Record:**
- **Benefit:** Enables tested hardware on an existing driver; 3-line
  change.
- **Risk:** Very low — no logic changes, no API changes.
- **Ratio:** Favorable for stable under the device-ID exception
  category.

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence Summary

**FOR backport:**
- Trivial I2C/OF device-ID addition to an **existing** driver (explicit
  stable exception category)
- Hardware-tested; crypto maintainer applied and Signed-off-by
- Applies cleanly to 6.18.43
- Driver already present in this tree since 6.18
- Without it, ATECC608B hardware cannot use the driver at all

**AGAINST backport:**
- Not a bug fix (crash/leak/race/security)
- Driver itself is new in 6.18 (limited exposure window)
- Companion DT binding patch (2/2) is separate — needed for full DT
  schema compliance but not for driver functionality
- No user bug reports or syzbot findings

### Step 9.2: Stable Rules Checklist

| Criterion | Result |
|-----------|--------|
| 1. Obviously correct and tested? | **PASS** — hardware tested,
maintainer applied |
| 2. Fixes a real bug? | **PASS via exception** — device-ID addition
enabling hardware that cannot bind otherwise |
| 3. Important issue? | **PASS (moderate)** — hardware non-functional
without it; not crash/security |
| 4. Small and contained? | **PASS** — 3 lines, one file |
| 5. No new features/APIs? | **PASS** — only match table entries; falls
under device-ID exception |
| 6. Can apply to local tree? | **PASS** — clean apply verified |

### Step 9.3: Exception Category
**Record:** **NEW DEVICE IDs** — adding OF compatible and I2C device ID
to an existing driver. The `atmel-ecc` driver is already in 6.18.y; only
the ID for ATECC608B is new.

### Step 9.4: Decision Rationale

This commit does not fix a kernel bug, but it is a textbook stable
exception: a minimal device-ID addition to an existing driver that
enables real hardware already validated by the author and accepted by
the crypto maintainer. The driver is present in 6.18.43, the patch
applies cleanly, and ATECC608B boards cannot use the driver without it.
Risk is negligible.

---

## Verification

- **[Phase 1]** Parsed commit message from `git show beb0043891b43`:
  subject, tags, body analyzed
- **[Phase 2]** Diff analysis: 3 lines added to `atmel-ecc.c` device-ID
  tables only
- **[Phase 3]** `git blame -L 370,390`: tables from `5d324e5159d9e`
  (6.18-rc8 merge)
- **[Phase 3]** `git log -20 -- drivers/crypto/atmel-ecc.c`: driver +
  one prior bug fix in tree
- **[Phase 3]** `git merge-base --is-ancestor 5d324e5159d9e HEAD`:
  driver merge is ancestor — driver exists
- **[Phase 3]** `git apply --check` on commit diff: **applies cleanly**
- **[Phase 4]** `b4 dig -c beb0043891b43`: lore URL found
- **[Phase 4]** `b4 dig -a`: v1 and RESEND revisions found
- **[Phase 4]** `b4 dig -w`: Herbert Xu, linux-crypto@ CC'd
- **[Phase 4]** `b4 dig -m /tmp/atecc608b.mbox`: Herbert Xu “All
  applied. Thanks.”; patch 2/2 identified as DT binding only
- **[Phase 5]** Read `atmel-i2c.c` `device_sanity_check()`: chip-family-
  agnostic sanity check
- **[Phase 5]** Read `atmel_ecc_probe()`: standard probe path, no chip-
  specific branches
- **[Phase 6]** `git describe HEAD` + `make kernelversion`: tree is
  **6.18.43**
- **[Phase 6]** `grep atecc608`: **no matches** in current tree — IDs
  absent
- **[Phase 6]** `grep atecc508`: DTS files and driver present — driver
  exists, only 508a supported
- **[Phase 7]** `Kconfig CRYPTO_DEV_ATMEL_ECC`: driver is tristate,
  depends on I2C
- **[Phase 8]** No crash/corruption path identified; functional gap for
  ATECC608B hardware

**YES****Verdict: YES** — backport to this tree (Linux 6.18.43).

This is a 3-line device-ID addition (`atmel,atecc608b` OF compatible +
I2C ID) to the existing `atmel-ecc` driver. It enables ATECC608B
hardware that otherwise won't bind; it was hardware-tested and accepted
by Herbert Xu. The patch applies cleanly to the current tree.

Note: it's patch 1/2 of a series — patch 2/2 adds the DT binding in
`trivial-devices.yaml` and would be needed separately for full Device
Tree schema compliance.

 drivers/crypto/atmel-ecc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/crypto/atmel-ecc.c b/drivers/crypto/atmel-ecc.c
index 9da5a03880807..8988fc3d8b9fd 100644
--- a/drivers/crypto/atmel-ecc.c
+++ b/drivers/crypto/atmel-ecc.c
@@ -372,6 +372,8 @@ static void atmel_ecc_remove(struct i2c_client *client)
 static const struct of_device_id atmel_ecc_dt_ids[] = {
 	{
 		.compatible = "atmel,atecc508a",
+	}, {
+		.compatible = "atmel,atecc608b",
 	}, {
 		/* sentinel */
 	}
@@ -381,6 +383,7 @@ MODULE_DEVICE_TABLE(of, atmel_ecc_dt_ids);
 
 static const struct i2c_device_id atmel_ecc_id[] = {
 	{ "atecc508a" },
+	{ "atecc608b" },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, atmel_ecc_id);
-- 
2.53.0