Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1034612AbcJ2ONL (ORCPT ); Sat, 29 Oct 2016 10:13:11 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:49814 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1030563AbcJ2Nwj (ORCPT ); Sat, 29 Oct 2016 09:52:39 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Romain Perier , Herbert Xu Subject: [PATCH 4.8 057/125] crypto: marvell - Update transformation context for each dequeued req Date: Sat, 29 Oct 2016 09:49:35 -0400 Message-Id: <20161029134949.561666000@linuxfoundation.org> X-Mailer: git-send-email 2.10.1 In-Reply-To: <20161029134947.232372651@linuxfoundation.org> References: <20161029134947.232372651@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1404 Lines: 40 4.8-stable review patch. If anyone has any objections, please let me know. ------------------ From: Romain Perier commit 09951d83fc58a6f772de09c08e370f6d9970dbb6 upstream. So far, sub part of mv_cesa_int was responsible of dequeuing complete requests, then call the 'cleanup' operation on these reqs and call the crypto api callback 'complete'. The problem is that the transformation context 'ctx' is retrieved only once before the while loop. Which means that the wrong 'cleanup' operation might be called on the wrong type of cesa requests, it can lead to memory corruptions with this message: marvell-cesa f1090000.crypto: dma_pool_free cesa_padding, 5a5a5a5a/5a5a5a5a (bad dma) This commit fixes the issue, by updating the transformation context for each dequeued cesa request. Fixes: commit 85030c5168f1 ("crypto: marvell - Add support for chai...") Signed-off-by: Romain Perier Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/marvell/cesa.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/crypto/marvell/cesa.c +++ b/drivers/crypto/marvell/cesa.c @@ -166,6 +166,7 @@ static irqreturn_t mv_cesa_int(int irq, if (!req) break; + ctx = crypto_tfm_ctx(req->tfm); mv_cesa_complete_req(ctx, req, 0); } }