[PATCH 0/3] crypto: qce - fix CCM AAD buffer leak and the AEAD error paths

[ZhaoJinming]

This series fixes a memory leak in the QCE AEAD driver together with two
bugs in the error handling around it.

qce_aead_ccm_prepare_buf_assoclen() allocates rctx->adata for every CCM
request that carries associated data, but the buffer is never freed.

While preparing that fix, two problems in the error path of
qce_aead_async_req_handle() turned out to matter:

  - It unmaps req->src although rctx->src_sg is the scatterlist that was
    passed to dma_map_sg().  For CCM requests with associated data,
    rctx->src_sg carries the AAD buffer, so its mapping is leaked, and
    freeing rctx->adata there would free memory that is still DMA-mapped.

  - A dma_map_sg() failure for the source scatterlist is not detected,
    because the result is checked for a negative value while
    dma_map_sg() returns 0 on failure.  The error path then unmaps a
    scatterlist that was never mapped.

Patch 1 unmaps the correct scatterlist, patch 2 adds the missing frees
and patch 3 fixes the dma_map_sg() check.

All three were reported as pre-existing in the Sashiko review of the QCE
BAM locking series.  They touch the same function that was recently fixed
by commit 7f2345f47dd1 ("crypto: qce - fix CCM AAD buffer
underallocation").

Signed-off-by: ZhaoJinming <zhaojinming@xxxxxxxxxxxxx>
---
ZhaoJinming (3):
      crypto: qce - unmap the correct scatterlist in the CCM error path
      crypto: qce - fix memory leak of the CCM AAD buffer
      crypto: qce - check dma_map_sg() result for the source scatterlist

 drivers/crypto/qce/aead.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)
---
base-commit: 0fcb05b72344f40806cbe810de8872f1698bf053
change-id: 20261015-fix-qce-ccm-adata-leak-1ef34f172ba1

Best regards,
--  
ZhaoJinming <zhaojinming@xxxxxxxxxxxxx>