patch 'crypto/dpaa2_sec: fix GCM decrypt buffer overflow' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/bf9c7f10d65ae01e7cd07c37f29865420d449f40

Thanks.

Luca Boccassi

---
>From bf9c7f10d65ae01e7cd07c37f29865420d449f40 Mon Sep 17 00:00:00 2001
From: Gagandeep Singh <g.singh at nxp.com>
Date: Tue, 6 Oct 2026 17:13:41 +0530
Subject: [PATCH] crypto/dpaa2_sec: fix GCM decrypt buffer overflow

[ upstream commit f2a09cc28dc0c236c014de8ec39a446d9b97637c ]

In build_authenc_gcm_fd, when both AAD (auth_only_len > 0) and decrypt
direction are active, the SGE layout occupies 8 entries plus 16 bytes of
old_icv storage at index 8. The FLE pool buffer was only 256 bytes
(8 x 32), causing old_icv to be written one entry past the end of the
allocated buffer. The resulting virtual address was not mapped by the
IOMMU, so DPAA2_VADDR_TO_IOVA returned 0 and the SEC engine received
iova=0x00000000 as the ICV buffer address, triggering an SMMU
translation fault (FSR=0x402 TF).

Additionally, the upfront bpid/IVP initialization only covered sge+3,
leaving sge+4 (the input data SGE when AAD is present) without a valid
bpid or IVP assignment.

Increase FLE_POOL_BUF_SIZE from 256 to 288 (9 x 32 bytes) to
accommodate the full layout, and extend the bpid/IVP initialization
to cover sge+4 in both branches of build_authenc_gcm_fd.

Fixes: 13273250eec5 ("crypto/dpaa2_sec: support AES-GCM and CTR")

Signed-off-by: Gagandeep Singh <g.singh at nxp.com>
---
 drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c | 2 ++
 drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h   | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c b/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
index 2381b43565c..655dfab75f8 100644
--- a/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
+++ b/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
@@ -531,6 +531,7 @@ build_authenc_gcm_fd(dpaa2_sec_session *sess,
 		DPAA2_SET_FLE_BPID(sge + 1, bpid);
 		DPAA2_SET_FLE_BPID(sge + 2, bpid);
 		DPAA2_SET_FLE_BPID(sge + 3, bpid);
+		DPAA2_SET_FLE_BPID(sge + 4, bpid);
 	} else {
 		DPAA2_SET_FD_IVP(fd);
 		DPAA2_SET_FLE_IVP(fle);
@@ -539,6 +540,7 @@ build_authenc_gcm_fd(dpaa2_sec_session *sess,
 		DPAA2_SET_FLE_IVP((sge + 1));
 		DPAA2_SET_FLE_IVP((sge + 2));
 		DPAA2_SET_FLE_IVP((sge + 3));
+		DPAA2_SET_FLE_IVP((sge + 4));
 	}
 
 	/* Save the shared descriptor */
diff --git a/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h b/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h
index 1c0bc3d6de8..770d92155f1 100644
--- a/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h
+++ b/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h
@@ -17,7 +17,7 @@ extern uint8_t cryptodev_driver_id;
 
 /* FLE_POOL_NUM_BUFS is set as per the ipsec-secgw application */
 #define FLE_POOL_NUM_BUFS	32000
-#define FLE_POOL_BUF_SIZE	256
+#define FLE_POOL_BUF_SIZE	288
 #define FLE_POOL_CACHE_SIZE	512
 #define FLE_SG_MEM_SIZE(num)	(FLE_POOL_BUF_SIZE + ((num) * 32))
 #define SEC_FLC_DHR_OUTBOUND	-114
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:45.692042994 +0000
+++ 0017-crypto-dpaa2_sec-fix-GCM-decrypt-buffer-overflow.patch	2026-11-05 16:42:44.905060308 +0000
@@ -1 +1 @@
-From f2a09cc28dc0c236c014de8ec39a446d9b97637c Mon Sep 17 00:00:00 2001
+From bf9c7f10d65ae01e7cd07c37f29865420d449f40 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit f2a09cc28dc0c236c014de8ec39a446d9b97637c ]
+
@@ -24 +25,0 @@
-Cc: stable at dpdk.org
@@ -33 +34 @@
-index 0d638363aa..a3be1eef70 100644
+index 2381b43565c..655dfab75f8 100644
@@ -36 +37 @@
-@@ -569,6 +569,7 @@ build_authenc_gcm_fd(dpaa2_sec_session *sess,
+@@ -531,6 +531,7 @@ build_authenc_gcm_fd(dpaa2_sec_session *sess,
@@ -44 +45 @@
-@@ -577,6 +578,7 @@ build_authenc_gcm_fd(dpaa2_sec_session *sess,
+@@ -539,6 +540,7 @@ build_authenc_gcm_fd(dpaa2_sec_session *sess,
@@ -53 +54 @@
-index 755c8e9cc3..ff32f3d860 100644
+index 1c0bc3d6de8..770d92155f1 100644
@@ -64 +65 @@
- 
+ #define SEC_FLC_DHR_OUTBOUND	-114