qce_aead_async_req_handle() maps the source with dma_map_sg(qce->dev, rctx->src_sg, rctx->src_nents, dir_src), but its error path unmaps req->src instead: error_unmap_src: if (diff_dst) dma_unmap_sg(qce->dev, req->src, rctx->src_nents, dir_src); For CCM requests with associated data and separate source and destination buffers, rctx->src_sg is a scatterlist freshly built by qce_aead_ccm_prepare_buf_assoclen() that carries the AAD, message and result buffers, so it is not req->src. The mapping created for rctx->src_sg is therefore leaked, and req->src is unmapped with a nents count that does not belong to it. Unmap rctx->src_sg, matching the dma_map_sg() call, as qce_aead_done() already does on the completion path. This also makes it safe to free rctx->adata on this path, which the next patch does. Fixes: 9363efb4181c ("crypto: qce - Add support for AEAD algorithms") Cc: stable@vger.kernel.org Signed-off-by: ZhaoJinming --- drivers/crypto/qce/aead.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c index a9642c67f476..f8e6054ff15d 100644 --- a/drivers/crypto/qce/aead.c +++ b/drivers/crypto/qce/aead.c @@ -478,7 +478,7 @@ qce_aead_async_req_handle(struct crypto_async_request *async_req) qce_dma_terminate_all(&qce->dma); error_unmap_src: if (diff_dst) - dma_unmap_sg(qce->dev, req->src, rctx->src_nents, dir_src); + dma_unmap_sg(qce->dev, rctx->src_sg, rctx->src_nents, dir_src); error_unmap_dst: dma_unmap_sg(qce->dev, rctx->dst_sg, rctx->dst_nents, dir_dst); error_free: -- 2.50.1