Linux cryptographic layer development
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: ZhaoJinming <zhaojinming@uniontech.com>,
	"Bartosz Golaszewski" <brgl@kernel.org>,
	"Herbert Xu" <herbert@gondor.apana.org.au>,
	"David S. Miller" <davem@davemloft.net>,
	"Thara Gopinath" <thara.gopinath@linaro.org>
Cc: linux-crypto@vger.kernel.org,
	"Eric Biggers" <ebiggers@kernel.org>,
	"Bartosz Golaszewski" <bartosz.golaszewski@oss.qualcomm.com>
Subject: Re: [PATCH v2 2/7] crypto: qce - fix memory leak of the CCM AAD buffer
Date: Fri, 13 Nov 2026 07:06:44 +0000	[thread overview]
Message-ID: <sashiko-outbox-212317@kernel.org> (raw)
In-Reply-To: <20261113-fix-qce-ccm-adata-leak-v2-2-914501377a62@uniontech.com>

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] crypto: qce: single-word name in Signed-off-by trailer
--

commit 8b5fc4cf5bc1b9c0817753d0bd63aca7091e3300
Author: ZhaoJinming <zhaojinming@uniontech.com>

> crypto: qce - fix memory leak of the CCM AAD buffer
>
> qce_aead_ccm_prepare_buf_assoclen() allocates rctx->adata with kzalloc()
> for every CCM request that carries associated data, but the buffer is
> never freed: qce_aead_done() releases only the scatterlist tables, and
> none of the error paths release it either.  Every such request therefore
> leaks a small allocation.
>
> Free rctx->adata in the completion handler and on all error paths: the
> sg_copy_to_buffer() and sg_alloc_table() failures in
> qce_aead_ccm_prepare_buf_assoclen() (through the new err_free_adata
> label) and the error cleanup of qce_aead_async_req_handle().
>
> The buffer is referenced by a scatterlist that is DMA-mapped, so it is
> freed only after dma_unmap_sg() has run.  The frees are guarded the same
> way as the surrounding sg_free_table() calls, so no path frees the
> buffer twice or frees a stale pointer.
>
> Fixes: 9363efb4181c ("crypto: qce - Add support for AEAD algorithms")
> Reported-by: Eric Biggers <ebiggers@kernel.org>
> Link: https://lore.kernel.org/linux-crypto/20260723183438.GB93534@quark/
> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>

[Severity: High]
Should the Author and Signed-off-by lines separate the given name and
family name with a space (e.g., "Zhao Jinming" or "Jinming Zhao") instead
of using the single word "ZhaoJinming", as required by the Developer's
Certificate of Origin in Documentation/process/submitting-patches.rst?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113-fix-qce-ccm-adata-leak-v2-0-914501377a62@uniontech.com?part=2

  reply	other threads:[~2026-11-13  7:06 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-13  6:54 [PATCH v2 0/7] crypto: qce - fix CCM AAD buffer leak and AEAD error-path bugs ZhaoJinming
2026-11-13  6:54 ` [PATCH v2 1/7] crypto: qce - unmap the correct scatterlist in the CCM error path ZhaoJinming
2026-11-13  6:54 ` [PATCH v2 2/7] crypto: qce - fix memory leak of the CCM AAD buffer ZhaoJinming
2026-11-13  7:06   ` sashiko-bot [this message]
2026-11-13  6:54 ` [PATCH v2 3/7] crypto: qce - check dma_map_sg() result for the source scatterlist ZhaoJinming
2026-11-13  6:54 ` [PATCH v2 4/7] crypto: qce - do not free an uninitialized dst_tbl on the error path ZhaoJinming
2026-11-13  6:54 ` [PATCH v2 5/7] crypto: qce - terminate the DMA channels if descriptor preparation fails ZhaoJinming
2026-11-13  6:54 ` [PATCH v2 6/7] crypto: qce - reject a negative scatterlist count in CCM AAD preparation ZhaoJinming
2026-11-13  7:08   ` sashiko-bot
2026-11-13  6:54 ` [PATCH v2 7/7] crypto: qce - release dst_tbl when the source scatterlist is invalid ZhaoJinming

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=sashiko-outbox-212317@kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=bartosz.golaszewski@oss.qualcomm.com \
    --cc=brgl@kernel.org \
    --cc=davem@davemloft.net \
    --cc=ebiggers@kernel.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=linux-crypto@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    --cc=thara.gopinath@linaro.org \
    --cc=zhaojinming@uniontech.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox