Repository navigation
uadk: fix buffer overflow and out-of-bounds access - #776
Merged
Merged
Conversation
Contributor
|
lgtm |
1 similar comment
Collaborator
|
lgtm |
Under SCHED_POLICY_DEV, allocating sync then async ctxs in two passes let concurrent contention split them across devices, leaving the async domain empty (async picks returned 65535, sends failed with -22). Add a DEV-only path that opens sync/async ctxs interleaved on ONE device: the first ctx auto-selects via NUMA scan, its dev_path pins every later ctx through preferred_dev_path, and wd_hw_alloc_ctx opens that device without NUMA fallback. Other policies unchanged. Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Replace interleaved sync/async alloc with linear two-pass per device: open all sync then all async; any shortfall rolls back the whole group and tries the next device. Add per-op_type gap check, device capacity pre-check, and dev_list NULL init. Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
wd_hw_alloc_ctx picked the first device whose wd_request_ctx() succeeded. When PF and VFs share the same NUMA node, the NUMA-distance sort is a no-op, so the device order comes from readdir() over /sys/class/uacce. Each concurrent business independently starts from the list head and binds all ctxs to the same leading device, starving the others. Select the device with the most available contexts (wd_get_avail_ctx) instead, with a fallback to the remaining devices if the chosen one fails to open. NUMA distance priority is unchanged. Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
|
/lgtm |
Unify BD3 fill/parse paths for cipher, digest, and aead on V3+ hardware. Previously each algorithm duplicated udata handling, scene selection, and DIF detection in qm_fill/qm_parse entry points. Route everything through fill_xxx_bd3/parse_xxx_bd3, add DIF and udata address helpers, select scene by is_storage, and guard unmap in error paths. BD1/BD2 paths retained for V2 hardware. Known limitation: aead storage scene (AES-CCM/GCM with Gran_Num=1, SCENE_STORAGE, CI_GEN_BY_LBA, DIF) is not implemented because wd_aead_udata lacks gran_num/dif/block_size. No regression from prior BD2 aead path; extending wd_aead_udata is left to a follow-up. Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
Common digests (SHA/SM3) need SCENE_STREAM for streaming hash but only CTR/GCM streaming was described in the FS, so hash streaming was misconfigured. GMAC uses SCENE_IPSEC independently. Use SCENE_STREAM for common digests; keep SCENE_IPSEC for GMAC only. Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
In sm3_ce_drv_send and isa_ce_cipher_send, the return value of the software digest/cipher computation (do_sm3_ce, do_hmac_sm3_ce, sm4_xts_encrypt, sm4_xts_decrypt) is silently overwritten by the subsequent wd_get_sqe_from_queue call. If the computation fails, the error is swallowed and the function may return success. Add an early return on error before calling wd_get_sqe_from_queue so that a failed computation does not proceed to queue operations. Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
In wd_rsa.c create_sess_key, prikey is allocated via sess->mm_ops.alloc which may be backed by mmap (WD_MMAP_MEM), but the pubkey alloc failure path freed it with free(), causing undefined behavior on mmap memory. Use sess->mm_ops.free to match the allocator and the normal release path in del_sess_key. Signed-off-by: Weili Qian <qianweili@huawei.com>
wd_alg_init_fallback in wd_util.c discarded fb_driver->init() return value and always returned 0, and wd_agg_rehash_sync_inner in wd_agg.c ignored wd_agg_set_col_size return value, allowing invalid column sizes to hardware DMA. Propagate the init return value and check wd_agg_set_col_size so callers can detect failures. Signed-off-by: Weili Qian <qianweili@huawei.com>
wd_parse_log_level in wd.c allocated st_size bytes but fscanf "%[^\n ]" appends a '\0', causing off-by-one heap overflow when a token is exactly st_size long. _find_next_bit in wd_mempool.c used "start > bits" in the loop guard while the initial guard used "start >= bits", reading map out of bounds when bits is a multiple of BITS_PER_LONG. Allocate st_size + 1 and use ">=" for the loop guard. Signed-off-by: Weili Qian <qianweili@huawei.com>
pthread_spin_init returns a positive errno on failure, but wd_blockpool_create/wd_mempool_create checked "if (ret < 0)" which was always false, and wd_soft_alloc_ctx did not check the return value at all, leaving spinlocks uninitialized. Use "if (ret)" to detect failure, check both spin_init calls in wd_soft_alloc_ctx, clean up on failure, and return -ret so callers using "if (ret < 0)" can detect the error. Signed-off-by: Weili Qian <qianweili@huawei.com>
hisi_qm_create_sglpool missed NULL check on hisi_qm_align_sgl and set sgl_num to i instead of i + 1 on failure, leaking the already-allocated sgl[i]. hisi_qm_get_hw_sgl, hisi_sec_cipher_send/_v3, cipher/digest/aead recv and fill_zip_comp_sqe also leaked SGL/DMA resources or passed NULL to hardware on error paths. Add NULL checks, fix sgl_num, and recycle SGL entries on error paths. Signed-off-by: Weili Qian <qianweili@huawei.com>
wd_*_poll_ctx in wd_ecc/rsa/dh/udma.c put recv_msg.tag (0 from zero-initialized recv_msg) back into the message pool on drv->recv failure, marking slot 0 as free even when in use and causing double-use or use-after-free. sm2_enc_parse in hisi_hpre.c leaked the second SQE and its DMA mappings when parse_second_sqe partially succeeded. Remove the wd_put_msg_to_pool call on recv failure to align with aead/cipher/digest, and free the second SQE before jumping to free_first. Signed-off-by: Weili Qian <qianweili@huawei.com>
wd_pool_init in wd_bmm.c allocated blk_array with malloc, leaving elements uninitialized and passing garbage blk/blk_dma to wd_iova_unmap on the error cleanup path. wd_comp_init_nolock in wd_comp.c called wd_alg_init_driver redundantly since the caller already invokes it, causing double initialization. Use calloc to zero-initialize blk_array and remove the redundant wd_alg_init_driver call to match other modules. Signed-off-by: Weili Qian <qianweili@huawei.com>
Several session alloc functions (agg, join_gather, udma) declared a local
struct wd_sched_params without initialization, setting only alg_name and
ctxs before passing to wd_sched_set_param, which reads pkt_size, data_mode
and prio_mode unconditionally. Uninitialized stack values caused
nondeterministic scheduling.
Initialize with = {0} at declaration, consistent with wd_comp_alloc_sess.
Signed-off-by: Weili Qian <qianweili@huawei.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.