[PATCH] crypto: qce - use the mapped scatterlist count for ahash requests

[Jinming Zhao]

qce_ahash_async_req_handle() maps the source scatterlist with
dma_map_sg(), which returns the number of entries after the DMA mapper
has coalesced them.  The driver keeps that value in ret but immediately
overwrites it with the result of the second dma_map_sg() call for the
result buffer, so qce_dma_prep_sgs() and the later unmaps use
rctx->src_nents, the count from sg_nents_for_len() before mapping.

When the DMA mapper merges entries, the descriptor is prepared with more
entries than were mapped, so the DMA engine may read sg_dma_address and
sg_dma_len from entries that were never populated.  This can lead to
IOMMU faults or memory corruption.  Store the mapped count in
rctx->src_nents so the descriptor and both unmap paths use the count
returned by dma_map_sg().

This issue was found in the Sashiko review of the "crypto: qce - fix CCM
AAD buffer leak and AEAD error-path bugs" series.

Link: https://sashiko.dev/#/patchset/20261016-fix-qce-ccm-adata-leak-v1-0-f54a82af2de0@xxxxxxxxxxxxx
Fixes: fea40451530fe ("crypto: qce - dma_map_sg can handle chained SG")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jinming Zhao <zhaojinming@xxxxxxxxxxxxx>
---
qce_ahash_async_req_handle() maps the source scatterlist with
dma_map_sg(), which returns the number of entries after the DMA mapper
has coalesced them.  The driver keeps that value in ret but then
overwrites it with the result of the second dma_map_sg() call for the
result buffer, so qce_dma_prep_sgs() and the later unmaps use the
rctx->src_nents value computed before mapping.

When the DMA mapper merges entries, the descriptor is prepared with more
entries than were mapped, so the DMA engine may read sg_dma_address and
sg_dma_len from entries that were never populated, which can lead to
IOMMU faults or memory corruption.  Store the mapped count in
rctx->src_nents so the descriptor and both unmap paths use the count
returned by dma_map_sg().

This issue was found in the Sashiko review of the "crypto: qce - fix CCM
AAD buffer leak and AEAD error-path bugs" series:
https://sashiko.dev/#/patchset/20261016-fix-qce-ccm-adata-leak-v1-0-f54a82af2de0%40uniontech.com
---
 drivers/crypto/qce/sha.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c
index b67d749db05f..c53d0e53784e 100644
--- a/drivers/crypto/qce/sha.c
+++ b/drivers/crypto/qce/sha.c
@@ -97,6 +97,12 @@ static int qce_ahash_async_req_handle(struct crypto_async_request *async_req)
 	if (!ret)
 		return -EIO;
 
+	/*
+	 * dma_map_sg() can coalesce entries, so use the number of mapped
+	 * entries for the descriptor and for the later unmap.
+	 */
+	rctx->src_nents = ret;
+
 	sg_init_one(&rctx->result_sg, qce->dma.result_buf, QCE_RESULT_BUF_SZ);
 
 	ret = dma_map_sg(qce->dev, &rctx->result_sg, 1, DMA_FROM_DEVICE);

---
base-commit: 7e1392a42ea288d70a266f6553fe06f57f8647ea
change-id: 20261113-qce-ahash-dma-count-41e47c59b17a

Best regards,
--  
Jinming Zhao <zhaojinming@xxxxxxxxxxxxx>