Unverified Commit c48dd34e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6179 crypto: hisilicon - fixed some code security review issues 

Merge Pull Request from: @xiao_jiang_shui 
 
1. Fix a memory leak issue
2. Fixed an issue where accessing uninitialized resources would be triggered in four special cases.
3. Round four cleanup patch

issue: https://gitee.com/openeuler/kernel/issues/I9GMIW 
 
Link:https://gitee.com/openeuler/kernel/pulls/6179

 

Reviewed-by: default avatarYang Shen <shenyang39@huawei.com>
Signed-off-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
parents 777ee5ee 9116b138

drivers/crypto/hisilicon/debugfs.c

+26 −12
Original line number Diff line number Diff line
@@ -311,7 +311,7 @@ static int q_dump_param_parse(struct hisi_qm *qm, char *s, 
static int qm_sq_dump(struct hisi_qm *qm, char *s, char *name)

{

	u16 sq_depth = qm->qp_array->cq_depth;

	void *sqe, *sqe_curr;

	void *sqe;

	struct hisi_qp *qp;

	u32 qp_id, sqe_id;

	int ret;
@@ -320,17 +320,16 @@ static int qm_sq_dump(struct hisi_qm *qm, char *s, char *name) 
	if (ret)

		return ret;



	sqe = kzalloc(qm->sqe_size * sq_depth, GFP_KERNEL);

	sqe = kzalloc(qm->sqe_size, GFP_KERNEL);

	if (!sqe)

		return -ENOMEM;



	qp = &qm->qp_array[qp_id];

	memcpy(sqe, qp->sqe, qm->sqe_size * sq_depth);

	sqe_curr = sqe + (u32)(sqe_id * qm->sqe_size);

	memset(sqe_curr + qm->debug.sqe_mask_offset, QM_SQE_ADDR_MASK,

	memcpy(sqe, qp->sqe + sqe_id * qm->sqe_size, qm->sqe_size);

	memset(sqe + qm->debug.sqe_mask_offset, QM_SQE_ADDR_MASK,

	       qm->debug.sqe_mask_len);



	dump_show(qm, sqe_curr, qm->sqe_size, name);

	dump_show(qm, sqe, qm->sqe_size, name);



	kfree(sqe);
@@ -809,8 +808,14 @@ static void dfx_regs_uninit(struct hisi_qm *qm, 
{

	int i;



	if (!dregs)

		return;



	/* Setting the pointer is NULL to prevent double free */

	for (i = 0; i < reg_len; i++) {

		if (!dregs[i].regs)

			continue;



		kfree(dregs[i].regs);

		dregs[i].regs = NULL;

	}
@@ -860,14 +865,21 @@ static struct dfx_diff_registers *dfx_regs_init(struct hisi_qm *qm, 
static int qm_diff_regs_init(struct hisi_qm *qm,

		struct dfx_diff_registers *dregs, u32 reg_len)

{

	int ret;



	qm->debug.qm_diff_regs = dfx_regs_init(qm, qm_diff_regs, ARRAY_SIZE(qm_diff_regs));

	if (IS_ERR(qm->debug.qm_diff_regs))

		return PTR_ERR(qm->debug.qm_diff_regs);

	if (IS_ERR(qm->debug.qm_diff_regs)) {

		ret = PTR_ERR(qm->debug.qm_diff_regs);

		qm->debug.qm_diff_regs = NULL;

		return ret;

	}



	qm->debug.acc_diff_regs = dfx_regs_init(qm, dregs, reg_len);

	if (IS_ERR(qm->debug.acc_diff_regs)) {

		dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));

		return PTR_ERR(qm->debug.acc_diff_regs);

		ret = PTR_ERR(qm->debug.acc_diff_regs);

		qm->debug.acc_diff_regs = NULL;

		return ret;

	}



	return 0;
@@ -908,7 +920,9 @@ static int qm_last_regs_init(struct hisi_qm *qm) 
static void qm_diff_regs_uninit(struct hisi_qm *qm, u32 reg_len)

{

	dfx_regs_uninit(qm, qm->debug.acc_diff_regs, reg_len);

	qm->debug.acc_diff_regs = NULL;

	dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));

	qm->debug.qm_diff_regs = NULL;

}



/**
@@ -1075,12 +1089,12 @@ static void qm_create_debugfs_file(struct hisi_qm *qm, struct dentry *dir, 
{

	struct debugfs_file *file = qm->debug.files + index;



	debugfs_create_file(qm_debug_file_name[index], 0600, dir, file,

			    &qm_debug_fops);



	file->index = index;

	mutex_init(&file->lock);

	file->debug = &qm->debug;



	debugfs_create_file(qm_debug_file_name[index], 0600, dir, file,

			    &qm_debug_fops);

}



static int qm_debugfs_atomic64_set(void *data, u64 val)

drivers/crypto/hisilicon/hpre/hpre_main.c

+10 −11
Original line number Diff line number Diff line
@@ -1065,41 +1065,40 @@ static int hpre_debugfs_init(struct hisi_qm *qm) 
	struct device *dev = &qm->pdev->dev;

	int ret;



	qm->debug.debug_root = debugfs_create_dir(dev_name(dev),

						  hpre_debugfs_root);



	qm->debug.sqe_mask_offset = HPRE_SQE_MASK_OFFSET;

	qm->debug.sqe_mask_len = HPRE_SQE_MASK_LEN;

	ret = hisi_qm_regs_debugfs_init(qm, hpre_diff_regs, ARRAY_SIZE(hpre_diff_regs));

	if (ret) {

		dev_warn(dev, "Failed to init HPRE diff regs!\n");

		goto debugfs_remove;

		return ret;

	}



	qm->debug.debug_root = debugfs_create_dir(dev_name(dev),

							hpre_debugfs_root);

	qm->debug.sqe_mask_offset = HPRE_SQE_MASK_OFFSET;

	qm->debug.sqe_mask_len = HPRE_SQE_MASK_LEN;



	hisi_qm_debug_init(qm);



	if (qm->pdev->device == PCI_DEVICE_ID_HUAWEI_HPRE_PF) {

		ret = hpre_ctrl_debug_init(qm);

		if (ret)

			goto failed_to_create;

			goto debugfs_remove;

	}



	hpre_dfx_debug_init(qm);



	return 0;



failed_to_create:

	hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(hpre_diff_regs));

debugfs_remove:

	debugfs_remove_recursive(qm->debug.debug_root);

	hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(hpre_diff_regs));

	return ret;

}



static void hpre_debugfs_exit(struct hisi_qm *qm)

{

	hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(hpre_diff_regs));



	debugfs_remove_recursive(qm->debug.debug_root);



	hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(hpre_diff_regs));

}



static int hpre_pre_store_cap_reg(struct hisi_qm *qm)

drivers/crypto/hisilicon/qm.c

+3 −0
Original line number Diff line number Diff line
@@ -733,6 +733,9 @@ int qm_set_and_get_xqc(struct hisi_qm *qm, u8 cmd, void *xqc, u32 qp_id, bool op 
		tmp_xqc = qm->xqc_buf.aeqc;

		xqc_dma = qm->xqc_buf.aeqc_dma;

		break;

	default:

		dev_err(&qm->pdev->dev, "unknown mailbox cmd %u\n", cmd);

		return -EINVAL;

	}



	/* Setting xqc will fail if master OOO is blocked. */

drivers/crypto/hisilicon/sec2/sec_crypto.c

+3 −1
Original line number Diff line number Diff line
@@ -481,8 +481,10 @@ static void sec_alg_resource_free(struct sec_ctx *ctx, 


	if (ctx->pbuf_supported)

		sec_free_pbuf_resource(dev, qp_ctx->res);

	if (ctx->alg_type == SEC_AEAD)

	if (ctx->alg_type == SEC_AEAD) {

		sec_free_mac_resource(dev, qp_ctx->res);

		sec_free_aiv_resource(dev, qp_ctx->res);

	}

}



static int sec_alloc_qp_ctx_resource(struct sec_ctx *ctx, struct sec_qp_ctx *qp_ctx)

drivers/crypto/hisilicon/sec2/sec_main.c

+13 −13
Original line number Diff line number Diff line
@@ -900,37 +900,36 @@ static int sec_debugfs_init(struct hisi_qm *qm) 
	struct device *dev = &qm->pdev->dev;

	int ret;



	qm->debug.debug_root = debugfs_create_dir(dev_name(dev),

						  sec_debugfs_root);

	qm->debug.sqe_mask_offset = SEC_SQE_MASK_OFFSET;

	qm->debug.sqe_mask_len = SEC_SQE_MASK_LEN;



	ret = hisi_qm_regs_debugfs_init(qm, sec_diff_regs, ARRAY_SIZE(sec_diff_regs));

	if (ret) {

		dev_warn(dev, "Failed to init SEC diff regs!\n");

		goto debugfs_remove;

		return ret;

	}



	qm->debug.debug_root = debugfs_create_dir(dev_name(dev),

							sec_debugfs_root);

	qm->debug.sqe_mask_offset = SEC_SQE_MASK_OFFSET;

	qm->debug.sqe_mask_len = SEC_SQE_MASK_LEN;



	hisi_qm_debug_init(qm);



	ret = sec_debug_init(qm);

	if (ret)

		goto failed_to_create;

		goto debugfs_remove;



	return 0;



failed_to_create:

	hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(sec_diff_regs));

debugfs_remove:

	debugfs_remove_recursive(sec_debugfs_root);

	debugfs_remove_recursive(qm->debug.debug_root);

	hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(sec_diff_regs));

	return ret;

}



static void sec_debugfs_exit(struct hisi_qm *qm)

{

	hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(sec_diff_regs));



	debugfs_remove_recursive(qm->debug.debug_root);



	hisi_qm_regs_debugfs_uninit(qm, ARRAY_SIZE(sec_diff_regs));

}



static int sec_show_last_regs_init(struct hisi_qm *qm)
@@ -1320,7 +1319,8 @@ static struct pci_driver sec_pci_driver = { 
	.probe = sec_probe,

	.remove = sec_remove,

	.err_handler = &sec_err_handler,

	.sriov_configure = hisi_qm_sriov_configure,

	.sriov_configure = IS_ENABLED(CONFIG_PCI_IOV) ?

				hisi_qm_sriov_configure : NULL,

	.shutdown = hisi_qm_dev_shutdown,

	.driver.pm = &sec_pm_ops,

};