]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/commit
crypto: s5p-sss - Close possible race for completed requests
authorKrzysztof Kozlowski <krzk@kernel.org>
Fri, 17 Mar 2017 14:49:19 +0000 (16:49 +0200)
committerStefan Bader <stefan.bader@canonical.com>
Tue, 20 Jun 2017 08:50:22 +0000 (10:50 +0200)
commit5daded34c05ce4ca552c4719495b71d8725ac80a
tree3145fe0c42ff0f8f9d66c0ffc2daac41583d94d2
parentc8bde33591eb2a76941423a096f7b099467aa85c
crypto: s5p-sss - Close possible race for completed requests

BugLink: http://bugs.launchpad.net/bugs/1692898
commit 42d5c176b76e190a4a3e0dfeffdae661755955b6 upstream.

Driver is capable of handling only one request at a time and it stores
it in its state container struct s5p_aes_dev.  This stored request must be
protected between concurrent invocations (e.g. completing current
request and scheduling new one).  Combination of lock and "busy" field
is used for that purpose.

When "busy" field is true, the driver will not accept new request thus
it will not overwrite currently handled data.

However commit 28b62b145868 ("crypto: s5p-sss - Fix spinlock recursion
on LRW(AES)") moved some of the write to "busy" field out of a lock
protected critical section.  This might lead to potential race between
completing current request and scheduling a new one.  Effectively the
request completion might try to operate on new crypto request.

Fixes: 28b62b145868 ("crypto: s5p-sss - Fix spinlock recursion on LRW(AES)")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
drivers/crypto/s5p-sss.c