From: Weili Qian <qianweili@huawei.com> wd_*_poll_ctx in wd_ecc/rsa/dh/udma.c put recv_msg.tag (0 from zero-initialized recv_msg) back into the message pool on drv->recv failure, marking slot 0 as free even when in use and causing double-use or use-after-free. sm2_enc_parse in hisi_hpre.c leaked the second SQE and its DMA mappings when parse_second_sqe partially succeeded. Remove the wd_put_msg_to_pool call on recv failure to align with aead/cipher/digest, and free the second SQE before jumping to free_first. Signed-off-by: Weili Qian <qianweili@huawei.com> --- drv/hisi_hpre.c | 2 ++ wd_dh.c | 2 -- wd_ecc.c | 2 -- wd_rsa.c | 2 -- wd_udma.c | 2 -- 5 files changed, 2 insertions(+), 8 deletions(-) diff --git a/drv/hisi_hpre.c b/drv/hisi_hpre.c index 70abe92..6d61fa4 100644 --- a/drv/hisi_hpre.c +++ b/drv/hisi_hpre.c @@ -2713,6 +2713,8 @@ static int sm2_enc_parse(handle_t h_qp, struct wd_ecc_msg *msg, ret = parse_second_sqe(h_qp, msg, &second); if (unlikely(ret)) { WD_ERR("failed to parse second BD, ret = %d!\n", ret); + if (second) + free_req(second); goto free_first; } diff --git a/wd_dh.c b/wd_dh.c index 8026fd6..f9958b2 100644 --- a/wd_dh.c +++ b/wd_dh.c @@ -520,8 +520,6 @@ int wd_dh_poll_ctx(__u32 idx, __u32 expt, __u32 *count) } else if (unlikely(ret)) { WD_ERR("failed to async recv, ret = %d!\n", ret); *count = rcv_cnt; - wd_put_msg_to_pool(&wd_dh_setting.pool, idx, - rcv_msg.tag); return ret; } rcv_cnt++; diff --git a/wd_ecc.c b/wd_ecc.c index 4b141c4..679a3fb 100644 --- a/wd_ecc.c +++ b/wd_ecc.c @@ -2519,8 +2519,6 @@ int wd_ecc_poll_ctx(__u32 idx, __u32 expt, __u32 *count) } else if (ret < 0) { WD_ERR("failed to async recv, ret = %d!\n", ret); *count = rcv_cnt; - wd_put_msg_to_pool(&wd_ecc_setting.pool, idx, - recv_msg.tag); return ret; } rcv_cnt++; diff --git a/wd_rsa.c b/wd_rsa.c index 59c230d..539285d 100644 --- a/wd_rsa.c +++ b/wd_rsa.c @@ -583,8 +583,6 @@ int wd_rsa_poll_ctx(__u32 idx, __u32 expt, __u32 *count) return ret; } else if (ret < 0) { WD_ERR("failed to async recv, ret = %d!\n", ret); - wd_put_msg_to_pool(&wd_rsa_setting.pool, idx, - recv_msg.tag); return ret; } rcv_cnt++; diff --git a/wd_udma.c b/wd_udma.c index 582c8d1..e329838 100644 --- a/wd_udma.c +++ b/wd_udma.c @@ -337,8 +337,6 @@ static int wd_udma_poll_ctx(__u32 idx, __u32 expt, __u32 *count) } else if (unlikely(ret)) { WD_ERR("failed to async recv, ret = %d!\n", ret); *count = rcv_cnt; - wd_put_msg_to_pool(&wd_udma_setting.pool, idx, - rcv_msg.tag); return ret; } rcv_cnt++; -- 2.50.1.windows.1