Patch "crypto: caam - fix error path for ctx_dma mapping failure" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

crypto: caam - fix error path for ctx_dma mapping failure

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
crypto-caam-fix-error-path-for-ctx_dma-mapping-failure.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: =?UTF-8?q?Horia=20Geant=C4=83?= <[email protected]>
Date: Fri, 10 Feb 2017 14:07:23 +0200
Subject: crypto: caam - fix error path for ctx_dma mapping failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Horia Geantă <[email protected]>

commit 87ec02e7409d787348c244039aa3536a812dfa8b upstream.

In case ctx_dma dma mapping fails, ahash_unmap_ctx() tries to dma unmap an invalid address:
map_seq_out_ptr_ctx() / ctx_map_to_sec4_sg() -> goto unmap_ctx -> -> ahash_unmap_ctx() -> dma unmap ctx_dma

There is also possible to reach ahash_unmap_ctx() with ctx_dma uninitialzed or to try to unmap the same address twice.

Fix these by setting ctx_dma = 0 where needed:
-initialize ctx_dma in ahash_init()
-clear ctx_dma in case of mapping error (instead of holding the error code returned by the dma map function) -clear ctx_dma after each unmapping

---
 drivers/crypto/caam/caamhash.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

@@ -154,6 +154,7 @@ static inline int map_seq_out_ptr_ctx(u3
 					ctx_len, DMA_FROM_DEVICE);
 	if (dma_mapping_error(jrdev, state->ctx_dma)) {
 		dev_err(jrdev, "unable to map ctx\n");
+		state->ctx_dma = 0;
 		return -ENOMEM;
 	}
 

@@ -214,6 +215,7 @@ static inline int ctx_map_to_sec4_sg(u32
 	state->ctx_dma = dma_map_single(jrdev, state->caam_ctx, ctx_len, flag);
 	if (dma_mapping_error(jrdev, state->ctx_dma)) {
 		dev_err(jrdev, "unable to map ctx\n");
+		state->ctx_dma = 0;
 		return -ENOMEM;
 	}
 

@@ -620,8 +622,10 @@ static inline void ahash_unmap_ctx(struc
 	struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash);
 	struct caam_hash_state *state = ahash_request_ctx(req);
 
-	if (state->ctx_dma)
+	if (state->ctx_dma) {
 		dma_unmap_single(dev, state->ctx_dma, ctx->ctx_len, flag);
+		state->ctx_dma = 0;
+	}
 	ahash_unmap(dev, edesc, req, dst_len);
 }
 

@@ -1605,6 +1609,7 @@ static int ahash_init(struct ahash_reque
 	state->finup = ahash_finup_first;
 	state->final = ahash_final_no_ctx;
 
+	state->ctx_dma = 0;
 	state->current_buf = 0;
 	state->buf_dma = 0;
 	state->buflen_0 = 0;

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/crypto-caam-fix-error-path-for-ctx_dma-mapping-failure.patch