[PATCH v2 7/7] crypto: qce - release dst_tbl when the source scatterlist is invalid

[ZhaoJinming]

qce_aead_prepare_buf() calls qce_aead_prepare_dst_buf(), which allocates
rctx->dst_tbl, and then validates the source scatterlist with
sg_nents_for_len().  If the source is shorter than the requested length,
the function returns -EINVAL without freeing rctx->dst_tbl, and
qce_aead_async_req_handle() propagates the error with a plain return
instead of going through its error_free cleanup.

Free rctx->dst_tbl on this error path.

Fixes: 9363efb4181c ("crypto: qce - Add support for AEAD algorithms")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: ZhaoJinming <zhaojinming@xxxxxxxxxxxxx>
---
 drivers/crypto/qce/aead.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c
index f75e3827d8bc..78c168086c5b 100644
--- a/drivers/crypto/qce/aead.c
+++ b/drivers/crypto/qce/aead.c
@@ -322,6 +322,7 @@ static int qce_aead_prepare_buf(struct aead_request *req)
 		rctx->src_nents = sg_nents_for_len(req->src, totallen);
 		if (rctx->src_nents < 0) {
 			dev_err(qce->dev, "Invalid numbers of src SG.\n");
+			sg_free_table(&rctx->dst_tbl);
 			return -EINVAL;
 		}
 		rctx->src_sg = req->src;

-- 
2.50.1