Hello,
There seems to be a double free on lines 1172 and 1213.
julia
---------- Forwarded message ----------
Date: Sun, 22 Mar 2020 17:21:30 +0800
From: kbuild test robot <lkp@xxxxxxxxx>
To: kbuild@xxxxxxxxxxxx
Cc: Julia Lawall <julia.lawall@xxxxxxx>
Subject: [cryptodev:master 149/150]
drivers/crypto/marvell/octeontx/otx_cptvf_algs.c:1213:7-10: ERROR: reference
preceded by free on line 1172
CC: kbuild-all@xxxxxxxxxxxx
CC: linux-crypto@xxxxxxxxxxxxxxx
TO: SrujanaChalla <schalla@xxxxxxxxxxx>
CC: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
head: f6913d040c8d2d8294d0a06c9d2a2aa4a02fb8c0
commit: 6482023b9d3350bf1b756ef36e1ea1a1c871879c [149/150] crypto: marvell - enable OcteonTX cpt options for build
:::::: branch date: 2 days ago
:::::: commit date: 2 days ago
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@xxxxxxxxx>
Reported-by: Julia Lawall <julia.lawall@xxxxxxx>
>> drivers/crypto/marvell/octeontx/otx_cptvf_algs.c:1213:7-10: ERROR: reference preceded by free on line 1172
# https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git/commit/?id=6482023b9d3350bf1b756ef36e1ea1a1c871879c
git remote add cryptodev https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git
git remote update cryptodev
git checkout 6482023b9d3350bf1b756ef36e1ea1a1c871879c
vim +1213 drivers/crypto/marvell/octeontx/otx_cptvf_algs.c
10b4f09491bfeb SrujanaChalla 2020-03-13 1130
10b4f09491bfeb SrujanaChalla 2020-03-13 1131 static inline u32 create_aead_null_output_list(struct aead_request *req,
10b4f09491bfeb SrujanaChalla 2020-03-13 1132 u32 enc, u32 mac_len)
10b4f09491bfeb SrujanaChalla 2020-03-13 1133 {
10b4f09491bfeb SrujanaChalla 2020-03-13 1134 struct otx_cpt_req_ctx *rctx = aead_request_ctx(req);
10b4f09491bfeb SrujanaChalla 2020-03-13 1135 struct otx_cpt_req_info *req_info = &rctx->cpt_req;
10b4f09491bfeb SrujanaChalla 2020-03-13 1136 struct scatterlist *dst;
10b4f09491bfeb SrujanaChalla 2020-03-13 1137 u8 *ptr = NULL;
10b4f09491bfeb SrujanaChalla 2020-03-13 1138 int argcnt = 0, status, offset;
10b4f09491bfeb SrujanaChalla 2020-03-13 1139 u32 inputlen;
10b4f09491bfeb SrujanaChalla 2020-03-13 1140
10b4f09491bfeb SrujanaChalla 2020-03-13 1141 if (enc)
10b4f09491bfeb SrujanaChalla 2020-03-13 1142 inputlen = req->cryptlen + req->assoclen;
10b4f09491bfeb SrujanaChalla 2020-03-13 1143 else
10b4f09491bfeb SrujanaChalla 2020-03-13 1144 inputlen = req->cryptlen + req->assoclen - mac_len;
10b4f09491bfeb SrujanaChalla 2020-03-13 1145
10b4f09491bfeb SrujanaChalla 2020-03-13 1146 /*
10b4f09491bfeb SrujanaChalla 2020-03-13 1147 * If source and destination are different
10b4f09491bfeb SrujanaChalla 2020-03-13 1148 * then copy payload to destination
10b4f09491bfeb SrujanaChalla 2020-03-13 1149 */
10b4f09491bfeb SrujanaChalla 2020-03-13 1150 if (req->src != req->dst) {
10b4f09491bfeb SrujanaChalla 2020-03-13 1151
10b4f09491bfeb SrujanaChalla 2020-03-13 1152 ptr = kmalloc(inputlen, (req_info->areq->flags &
10b4f09491bfeb SrujanaChalla 2020-03-13 1153 CRYPTO_TFM_REQ_MAY_SLEEP) ?
10b4f09491bfeb SrujanaChalla 2020-03-13 1154 GFP_KERNEL : GFP_ATOMIC);
10b4f09491bfeb SrujanaChalla 2020-03-13 1155 if (!ptr) {
10b4f09491bfeb SrujanaChalla 2020-03-13 1156 status = -ENOMEM;
10b4f09491bfeb SrujanaChalla 2020-03-13 1157 goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13 1158 }
10b4f09491bfeb SrujanaChalla 2020-03-13 1159
10b4f09491bfeb SrujanaChalla 2020-03-13 1160 status = sg_copy_to_buffer(req->src, sg_nents(req->src), ptr,
10b4f09491bfeb SrujanaChalla 2020-03-13 1161 inputlen);
10b4f09491bfeb SrujanaChalla 2020-03-13 1162 if (status != inputlen) {
10b4f09491bfeb SrujanaChalla 2020-03-13 1163 status = -EINVAL;
10b4f09491bfeb SrujanaChalla 2020-03-13 1164 goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13 1165 }
10b4f09491bfeb SrujanaChalla 2020-03-13 1166 status = sg_copy_from_buffer(req->dst, sg_nents(req->dst), ptr,
10b4f09491bfeb SrujanaChalla 2020-03-13 1167 inputlen);
10b4f09491bfeb SrujanaChalla 2020-03-13 1168 if (status != inputlen) {
10b4f09491bfeb SrujanaChalla 2020-03-13 1169 status = -EINVAL;
10b4f09491bfeb SrujanaChalla 2020-03-13 1170 goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13 1171 }
10b4f09491bfeb SrujanaChalla 2020-03-13 @1172 kfree(ptr);
10b4f09491bfeb SrujanaChalla 2020-03-13 1173 }
10b4f09491bfeb SrujanaChalla 2020-03-13 1174
10b4f09491bfeb SrujanaChalla 2020-03-13 1175 if (enc) {
10b4f09491bfeb SrujanaChalla 2020-03-13 1176 /*
10b4f09491bfeb SrujanaChalla 2020-03-13 1177 * In an encryption scenario hmac needs
10b4f09491bfeb SrujanaChalla 2020-03-13 1178 * to be appended after payload
10b4f09491bfeb SrujanaChalla 2020-03-13 1179 */
10b4f09491bfeb SrujanaChalla 2020-03-13 1180 dst = req->dst;
10b4f09491bfeb SrujanaChalla 2020-03-13 1181 offset = inputlen;
10b4f09491bfeb SrujanaChalla 2020-03-13 1182 while (offset >= dst->length) {
10b4f09491bfeb SrujanaChalla 2020-03-13 1183 offset -= dst->length;
10b4f09491bfeb SrujanaChalla 2020-03-13 1184 dst = sg_next(dst);
10b4f09491bfeb SrujanaChalla 2020-03-13 1185 if (!dst) {
10b4f09491bfeb SrujanaChalla 2020-03-13 1186 status = -ENOENT;
10b4f09491bfeb SrujanaChalla 2020-03-13 1187 goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13 1188 }
10b4f09491bfeb SrujanaChalla 2020-03-13 1189 }
10b4f09491bfeb SrujanaChalla 2020-03-13 1190
10b4f09491bfeb SrujanaChalla 2020-03-13 1191 update_output_data(req_info, dst, offset, mac_len, &argcnt);
10b4f09491bfeb SrujanaChalla 2020-03-13 1192 } else {
10b4f09491bfeb SrujanaChalla 2020-03-13 1193 /*
10b4f09491bfeb SrujanaChalla 2020-03-13 1194 * In a decryption scenario calculated hmac for received
10b4f09491bfeb SrujanaChalla 2020-03-13 1195 * payload needs to be compare with hmac received
10b4f09491bfeb SrujanaChalla 2020-03-13 1196 */
10b4f09491bfeb SrujanaChalla 2020-03-13 1197 status = sg_copy_buffer(req->src, sg_nents(req->src),
10b4f09491bfeb SrujanaChalla 2020-03-13 1198 rctx->fctx.hmac.s.hmac_recv, mac_len,
10b4f09491bfeb SrujanaChalla 2020-03-13 1199 inputlen, true);
10b4f09491bfeb SrujanaChalla 2020-03-13 1200 if (status != mac_len) {
10b4f09491bfeb SrujanaChalla 2020-03-13 1201 status = -EINVAL;
10b4f09491bfeb SrujanaChalla 2020-03-13 1202 goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13 1203 }
10b4f09491bfeb SrujanaChalla 2020-03-13 1204
10b4f09491bfeb SrujanaChalla 2020-03-13 1205 req_info->out[argcnt].vptr = rctx->fctx.hmac.s.hmac_calc;
10b4f09491bfeb SrujanaChalla 2020-03-13 1206 req_info->out[argcnt].size = mac_len;
10b4f09491bfeb SrujanaChalla 2020-03-13 1207 argcnt++;
10b4f09491bfeb SrujanaChalla 2020-03-13 1208 }
10b4f09491bfeb SrujanaChalla 2020-03-13 1209
10b4f09491bfeb SrujanaChalla 2020-03-13 1210 req_info->outcnt = argcnt;
10b4f09491bfeb SrujanaChalla 2020-03-13 1211 return 0;
10b4f09491bfeb SrujanaChalla 2020-03-13 1212 error:
10b4f09491bfeb SrujanaChalla 2020-03-13 @1213 kfree(ptr);
10b4f09491bfeb SrujanaChalla 2020-03-13 1214 return status;
10b4f09491bfeb SrujanaChalla 2020-03-13 1215 }
10b4f09491bfeb SrujanaChalla 2020-03-13 1216
:::::: The code at line 1213 was first introduced by commit
:::::: 10b4f09491bfeb0b298cb2f49df585510ee6189a crypto: marvell - add the Virtual Function driver for CPT
:::::: TO: SrujanaChalla <schalla@xxxxxxxxxxx>
:::::: CC: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@xxxxxxxxxxxx
