qce_aead_async_req_handle() maps the source scatterlist with dma_map_sg(), which returns 0 on failure, but the result is checked with: if (src_nents < 0) { ret = src_nents; goto error_unmap_dst; } so a mapping failure is not detected. The code then calls qce_dma_prep_sgs() with zero source entries, which fails, and the error path calls dma_unmap_sg() on a scatterlist that was never mapped. Check for !src_nents instead and return -EIO, matching the check that is already used for the destination scatterlist. The error_unmap_dst path skips the source unmap and only releases the destination mapping, which is the one that was successfully created. Fixes: 9363efb4181c ("crypto: qce - Add support for AEAD algorithms") Cc: stable@vger.kernel.org Signed-off-by: ZhaoJinming --- drivers/crypto/qce/aead.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c index 5bf59cb9ae9a..15ce778f019a 100644 --- a/drivers/crypto/qce/aead.c +++ b/drivers/crypto/qce/aead.c @@ -456,8 +456,8 @@ qce_aead_async_req_handle(struct crypto_async_request *async_req) if (diff_dst) { src_nents = dma_map_sg(qce->dev, rctx->src_sg, rctx->src_nents, dir_src); - if (src_nents < 0) { - ret = src_nents; + if (!src_nents) { + ret = -EIO; goto error_unmap_dst; } } else { -- 2.50.1