Commit 01fd2c13 authored by Weili Qian's avatar Weili Qian Committed by JangShui Yang
Browse files

crypto: hisilicon/qm - fix the type value of aeq 

mainline inclusion
from mainline-v6.7-rc1
commit ff3ddca9ca153d8a0ba0ed9325b15bdca92df769
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I925L9
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ff3ddca9ca153d8a0ba0ed9325b15bdca92df769



----------------------------------------------------------------------

The type of aeq has only 4bits in dw0 17 to 20bits, but 15bits(17 to
31bits) are read in function qm_aeq_thread(). The remaining 11bits(21
to 31bits) are reserved for aeq, but may not be 0. To avoid getting
incorrect value of type, other bits are cleared.

Signed-off-by: default avatarWeili Qian <qianweili@huawei.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarJangShui Yang <yangjiangshui@h-partners.com>
parent 1c3a3627

drivers/crypto/hisilicon/qm.c

+3 −1
Original line number Diff line number Diff line
@@ -69,6 +69,7 @@ 


#define QM_AEQE_PHASE(aeqe)		((le32_to_cpu((aeqe)->dw0) >> 16) & 0x1)

#define QM_AEQE_TYPE_SHIFT		17

#define QM_AEQE_TYPE_MASK		0xf

#define QM_AEQE_CQN_MASK		GENMASK(15, 0)

#define QM_CQ_OVERFLOW			0

#define QM_EQ_OVERFLOW			1
@@ -1026,7 +1027,8 @@ static irqreturn_t qm_aeq_thread(int irq, void *data) 
	u32 type, qp_id;



	while (QM_AEQE_PHASE(aeqe) == qm->status.aeqc_phase) {

		type = le32_to_cpu(aeqe->dw0) >> QM_AEQE_TYPE_SHIFT;

		type = (le32_to_cpu(aeqe->dw0) >> QM_AEQE_TYPE_SHIFT) &

			QM_AEQE_TYPE_MASK;

		qp_id = le32_to_cpu(aeqe->dw0) & QM_AEQE_CQN_MASK;



		switch (type) {