Re: [PATCH 0/3] crypto: qce - fix CCM AAD buffer leak and the AEAD error paths

[赵金明]

Hi Eric,

Thanks - you're right, and I should have dug up the original thread
first. The Sashiko review only flagged these as pre-existing; you
reported them first. I'll credit that properly and resend:

    Reported-by: Eric Biggers <ebiggers@xxxxxxxxxx>
    Link: https://lore.kernel.org/linux-crypto/20260723183438.GB93534@quark/

I'll fold those trailers in and send a v2 shortly.

The remaining bugs you listed are on my radar; I can take them as
separate follow-ups unless you'd prefer otherwise.

Thanks,
ZhaoJinming



>On Fri, Oct 16, 2026 at 10:09:42AM +0800, ZhaoJinming wrote:



>> This series fixes a memory leak in the QCE AEAD driver together with two



>> bugs in the error handling around it.



>> 



>> qce_aead_ccm_prepare_buf_assoclen() allocates rctx->adata for every CCM



>> request that carries associated data, but the buffer is never freed.



>> 



>> While preparing that fix, two problems in the error path of



>> qce_aead_async_req_handle() turned out to matter:



>> 



>>?? - It unmaps req->src although rctx->src_sg is the scatterlist that was



>>???? passed to dma_map_sg().? For CCM requests with associated data,



>>???? rctx->src_sg carries the AAD buffer, so its mapping is leaked, and



>>???? freeing rctx->adata there would free memory that is still DMA-mapped.



>> 



>>?? - A dma_map_sg() failure for the source scatterlist is not detected,



>>???? because the result is checked for a negative value while



>>???? dma_map_sg() returns 0 on failure.? The error path then unmaps a



>>???? scatterlist that was never mapped.



>> 



>> Patch 1 unmaps the correct scatterlist, patch 2 adds the missing frees



>> and patch 3 fixes the dma_map_sg() check.



>> 



>> All three were reported as pre-existing in the Sashiko review of the QCE



>> BAM locking series.? They touch the same function that was recently fixed



>> by commit 7f2345f47dd1 ("crypto: qce - fix CCM AAD buffer



>> underallocation").



>



>Note that I reported these bugs (and others still unfixed) 3 months ago:



>https://lore.kernel.org/linux-crypto/20260723183438.GB93534@quark/



>



>- Eric



>