staging: ccree: copy IV to DMAable memory

We are being passed an IV buffer from unknown origin, which may be
stack allocated and thus not safe for DMA. Allocate a DMA safe
buffer for the IV and use that instead.

Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/ccree/ssi_cipher.c b/drivers/staging/ccree/ssi_cipher.c
index 78706f5bcfb4cbedc0f9596f3773571b045ab7fe..0b691034e6f5f4e485f96d801ff120f1baffb622 100644 (file)
--- a/drivers/staging/ccree/ssi_cipher.c
+++ b/drivers/staging/ccree/ssi_cipher.c
@@ -695,6 +695,7 @@ static int ssi_blkcipher_complete(struct device *dev,
        struct ablkcipher_request *req = (struct ablkcipher_request *)areq;
 
        ssi_buffer_mgr_unmap_blkcipher_request(dev, req_ctx, ivsize, src, dst);
+       kfree(req_ctx->iv);
 
        /*Decrease the inflight counter*/
        if (ctx_p->flow_mode == BYPASS && ctx_p->drvdata->inflight_counter > 0)
@@ -757,6 +758,17 @@ static int ssi_blkcipher_process(
                rc = 0;
                goto exit_process;
        }
+
+       /* The IV we are handed may be allocted from the stack so
+        * we must copy it to a DMAable buffer before use.
+        */
+       req_ctx->iv = kmalloc(ivsize, GFP_KERNEL);
+       if (!req_ctx->iv) {
+               rc = -ENOMEM;
+               goto exit_process;
+       }
+       memcpy(req_ctx->iv, info, ivsize);
+
        /*For CTS in case of data size aligned to 16 use CBC mode*/
        if (((nbytes % AES_BLOCK_SIZE) == 0) && (ctx_p->cipher_mode == DRV_CIPHER_CBC_CTS)) {
                ctx_p->cipher_mode = DRV_CIPHER_CBC;
@@ -778,7 +790,9 @@ static int ssi_blkcipher_process(
 
        /* STAT_PHASE_1: Map buffers */
 
-       rc = ssi_buffer_mgr_map_blkcipher_request(ctx_p->drvdata, req_ctx, ivsize, nbytes, info, src, dst);
+       rc = ssi_buffer_mgr_map_blkcipher_request(ctx_p->drvdata, req_ctx,
+                                                 ivsize, nbytes, req_ctx->iv,
+                                                 src, dst);
        if (unlikely(rc != 0)) {
                dev_err(dev, "map_request() failed\n");
                goto exit_process;
@@ -830,8 +844,10 @@ static int ssi_blkcipher_process(
        if (cts_restore_flag != 0)
                ctx_p->cipher_mode = DRV_CIPHER_CBC_CTS;
 
-       if (rc != -EINPROGRESS)
+       if (rc != -EINPROGRESS) {
                kfree(req_ctx->backup_info);
+               kfree(req_ctx->iv);
+       }
 
        return rc;
 }

diff --git a/drivers/staging/ccree/ssi_cipher.h b/drivers/staging/ccree/ssi_cipher.h
index f4999626b94ad52fe4c5d0980ec4ec3878f15575..25e6335c0d943790a272a2d1a15fce3c4660fa54 100644 (file)
--- a/drivers/staging/ccree/ssi_cipher.h
+++ b/drivers/staging/ccree/ssi_cipher.h
@@ -43,6 +43,7 @@ struct blkcipher_req_ctx {
        u32 out_nents;
        u32 out_mlli_nents;
        u8 *backup_info; /*store iv for generated IV flow*/
+       u8 *iv;
        bool is_giv;
        struct mlli_params mlli_params;
 };