Commit 4d4c15c4 authored by Weili Qian's avatar Weili Qian Committed by JiangShui
Browse files

crypto: hisilicon/qm - fix the type value of aeq 

maillist inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8B6T4
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ff3ddca9ca15



----------------------------------------------------------------------

The type of aeq has only 4bits in dw0 17 to 20bits, but 15bits(17 to
31bits) are read in function qm_aeq_thread(). The remaining 11bits(21
to 31bits) are reserved for aeq, but may not be 0. To avoid getting
incorrect value of type, other bits are cleared.

Signed-off-by: default avatarWeili Qian <qianweili@huawei.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarJiangShui Yang <yangjiangshui@h-partners.com>
parent 42a1ee56

drivers/crypto/hisilicon/qm.c

+3 −1
Original line number Diff line number Diff line
@@ -71,6 +71,7 @@ 


#define QM_AEQE_PHASE(aeqe)		((le32_to_cpu((aeqe)->dw0) >> 16) & 0x1)

#define QM_AEQE_TYPE_SHIFT		17

#define QM_AEQE_TYPE_MASK		0xf

#define QM_AEQE_CQN_MASK		GENMASK(15, 0)

#define QM_CQ_OVERFLOW			0

#define QM_EQ_OVERFLOW			1
@@ -1188,7 +1189,8 @@ static irqreturn_t qm_aeq_thread(int irq, void *data) 
	atomic64_inc(&qm->debug.dfx.aeq_irq_cnt);



	while (QM_AEQE_PHASE(aeqe) == qm->status.aeqc_phase) {

		type = le32_to_cpu(aeqe->dw0) >> QM_AEQE_TYPE_SHIFT;

		type = (le32_to_cpu(aeqe->dw0) >> QM_AEQE_TYPE_SHIFT) &

			QM_AEQE_TYPE_MASK;

		qp_id = le32_to_cpu(aeqe->dw0) & QM_AEQE_CQN_MASK;



		switch (type) {