Re: [PATCH 0/3] crypto: qce - fix CCM AAD buffer leak and the AEAD error paths

[Bartosz Golaszewski]

On Fri, 16 Oct 2026 04:09:42 +0200, ZhaoJinming
<zhaojinming@xxxxxxxxxxxxx> said:
> This series fixes a memory leak in the QCE AEAD driver together with two
> bugs in the error handling around it.
>
> qce_aead_ccm_prepare_buf_assoclen() allocates rctx->adata for every CCM
> request that carries associated data, but the buffer is never freed.
>
> While preparing that fix, two problems in the error path of
> qce_aead_async_req_handle() turned out to matter:
>
>   - It unmaps req->src although rctx->src_sg is the scatterlist that was
>     passed to dma_map_sg().  For CCM requests with associated data,
>     rctx->src_sg carries the AAD buffer, so its mapping is leaked, and
>     freeing rctx->adata there would free memory that is still DMA-mapped.
>
>   - A dma_map_sg() failure for the source scatterlist is not detected,
>     because the result is checked for a negative value while
>     dma_map_sg() returns 0 on failure.  The error path then unmaps a
>     scatterlist that was never mapped.
>
> Patch 1 unmaps the correct scatterlist, patch 2 adds the missing frees
> and patch 3 fixes the dma_map_sg() check.
>
> All three were reported as pre-existing in the Sashiko review of the QCE
> BAM locking series.  They touch the same function that was recently fixed
> by commit 7f2345f47dd1 ("crypto: qce - fix CCM AAD buffer
> underallocation").
>
> Signed-off-by: ZhaoJinming <zhaojinming@xxxxxxxxxxxxx>
> ---

All three look correct to me, thanks!

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxxxxxxxx>