linux-stable.git/drivers/crypto, branch linux-6.17.y

crypto: ccree - Correctly handle return of sg_nents_for_len

2025-12-18T12:59:51+00:00

[ Upstream commit 8700ce07c5c6bf27afa7b59a8d9cf58d783a7d5c ]

Fix error handling in cc_map_hash_request_update where sg_nents_for_len
return value was assigned to u32, converting negative errors to large
positive values before passing to sg_copy_to_buffer.

Check sg_nents_for_len return value and propagate errors before
assigning to areq_ctx->in_nents.

Fixes: b7ec8530687a ("crypto: ccree - use std api when possible")
Signed-off-by: Haotian Zhang 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: starfive - Correctly handle return of sg_nents_for_len

2025-12-18T12:59:51+00:00

[ Upstream commit e9eb52037a529fbb307c290e9951a62dd728b03d ]

The return value of sg_nents_for_len was assigned to an unsigned long
in starfive_hash_digest, causing negative error codes to be converted
to large positive integers.

Add error checking for sg_nents_for_len and return immediately on
failure to prevent potential buffer overflows.

Fixes: 7883d1b28a2b ("crypto: starfive - Add hash and HMAC support")
Signed-off-by: Haotian Zhang 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: iaa - Fix incorrect return value in save_iaa_wq()

2025-12-18T12:59:42+00:00

[ Upstream commit 76ce17f6f7f78ab79b9741388bdb4dafa985b4e9 ]

The save_iaa_wq() function unconditionally returns 0, even when an error
is encountered. This prevents the error code from being propagated to the
caller.

Fix this by returning the 'ret' variable, which holds the actual status
of the operations within the function.

Fixes: ea7a5cbb43696 ("crypto: iaa - Add Intel IAA Compression Accelerator crypto driver core")
Signed-off-by: Zilin Guan 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: hisilicon/qm - restore original qos values

2025-12-18T12:59:22+00:00

[ Upstream commit e7066160f5b4187ad9869b712fa7a35d3d5be6b9 ]

When the new qos valus setting fails, restore to
the original qos values.

Fixes: 72b010dc33b9 ("crypto: hisilicon/qm - supports writing QoS int the host")
Signed-off-by: nieweiqiang 
Signed-off-by: Chenghai Huang 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value

2025-11-24T09:37:46+00:00

commit 59b0afd01b2ce353ab422ea9c8375b03db313a21 upstream.

The qm_get_qos_value() function calls bus_find_device_by_name() which
increases the device reference count, but fails to call put_device()
to balance the reference count and lead to a device reference leak.

Add put_device() calls in both the error path and success path to
properly balance the reference count.

Found via static analysis.

Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin 
Reviewed-by: Longfang Liu 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

crypto: hisilicon/qm - clear all VF configurations in the hardware

2025-11-13T20:37:28+00:00

[ Upstream commit 64b9642fc29a14e1fe67842be9c69c7b90a3bcd6 ]

When disabling SR-IOV, clear the configuration of each VF
in the hardware. Do not exit the configuration clearing process
due to the failure of a single VF. Additionally, Clear the VF
configurations before decrementing the PM counter.

Signed-off-by: Weili Qian 
Signed-off-by: Chenghai Huang 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: hisilicon/qm - invalidate queues in use

2025-11-13T20:37:28+00:00

[ Upstream commit 85acd1b26b8f5b838887dc965dc3aa2c0253f4d1 ]

Before the device reset, although the driver has set the queue
status to intercept doorbells sent by the task process, the reset
thread is isolated from the user-mode task process, so the task process
may still send doorbells. Therefore, before the reset, the queue is
directly invalidated, and the device directly discards the doorbells
sent by the process.

Signed-off-by: Weili Qian 
Signed-off-by: Chenghai Huang 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: caam - double the entropy delay interval for retry

2025-11-13T20:37:21+00:00

[ Upstream commit 9048beca9c5614d486e2b492c0a7867164bf56a8 ]

during entropy evaluation, if the generated samples fail
any statistical test, then, all of the bits will be discarded,
and a second set of samples will be generated and tested.

the entropy delay interval should be doubled before performing the
retry.

also, ctrlpriv->rng4_sh_init and inst_handles both reads RNG DRNG
status register, but only inst_handles is updated before every retry.
so only check inst_handles and removing ctrlpriv->rng4_sh_init

Signed-off-by: Gaurav Jain 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti()

2025-11-13T20:37:21+00:00

[ Upstream commit 2b0dc40ac6ca16ee0c489927f4856cf9cd3874c7 ]

payload_size field of the request header is incorrectly calculated using
sizeof(req). Since 'req' is a pointer (struct hsti_request *), sizeof(req)
returns the size of the pointer itself (e.g., 8 bytes on a 64-bit system),
rather than the size of the structure it points to. This leads to an
incorrect payload size being sent to the Platform Security Processor (PSP),
potentially causing the HSTI query command to fail.

Fix this by using sizeof(*req) to correctly calculate the size of the
struct hsti_request.

Signed-off-by: Yunseong Kim 
Reviewed-by: Mario Limonciello (AMD) > ---
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

crypto: sun8i-ce - remove channel timeout field

2025-11-13T20:37:21+00:00

[ Upstream commit 9a23ea1f7558bdd3f8d2b35b1c2e16a2f9bf671e ]

Using the number of bytes in the request as DMA timeout is really
inconsistent, as large requests could possibly set a timeout of
hundreds of seconds.

Remove the per-channel timeout field and use a single, static DMA
timeout of 3 seconds for all requests.

Signed-off-by: Ovidiu Panait 
Tested-by: Corentin LABBE 
Reviewed-by: Corentin LABBE 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin