Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare()[EOL][EOL]Fix two DMA cleanup issues on the error path in sun8i_ce_cipher_prepare():[EOL][EOL]1] If dma_map_sg() fails for areq->dst, the device driver would try to free[EOL]   DMA memory it has not allocated in the first place. To fix this, on the[EOL]   "theend_sgs" error path, call dma unmap only if the corresponding dma[EOL]   map was successful.[EOL][EOL]2] If the dma_map_single() call for the IV fails, the device driver would[EOL]   try to free an invalid DMA memory address on the "theend_iv" path:[EOL]   ------------[ cut here ]------------[EOL]   DMA-API: sun8i-ce 1904000.crypto: device driver tries to free an invalid DMA memory address[EOL]   WARNING: CPU: 2 PID: 69 at kernel/dma/debug.c:968 check_unmap+0x123c/0x1b90[EOL]   Modules linked in: skcipher_example(O+)[EOL]   CPU: 2 UID: 0 PID: 69 Comm: 1904000.crypto- Tainted: G           O        6.15.0-rc3+ #24 PREEMPT[EOL]   Tainted: [O]=OOT_MODULE[EOL]   Hardware name: OrangePi Zero2 (DT)[EOL]   pc : check_unmap+0x123c/0x1b90[EOL]   lr : check_unmap+0x123c/0x1b90[EOL]   ...[EOL]   Call trace:[EOL]    check_unmap+0x123c/0x1b90 (P)[EOL]    debug_dma_unmap_page+0xac/0xc0[EOL]    dma_unmap_page_attrs+0x1f4/0x5fc[EOL]    sun8i_ce_cipher_do_one+0x1bd4/0x1f40[EOL]    crypto_pump_work+0x334/0x6e0[EOL]    kthread_worker_fn+0x21c/0x438[EOL]    kthread+0x374/0x664[EOL]    ret_from_fork+0x10/0x20[EOL]   ---[ end trace 0000000000000000 ]---[EOL][EOL]To fix this, check for !dma_mapping_error() before calling[EOL]dma_unmap_single() on the "theend_iv" path.

CREATE(Triage):(User=admin) [CVE-2025-38300 (https://nvd.nist.gov/vuln/detail/CVE-2025-38300)