[PATCH v3 1/1] crypto: atmel-sha204a - fix heap info leak on I2C transfer failure

[Herbert Xu]

On Sat, Jun 13, 2026 at 08:20:37PM +0000, Lothar Rubusch wrote:
> The nonblocking RNG path allocates a work_data structure to track the
> state of an in-flight asynchronous I2C request. This pointer is stored
> in rng->priv and later consumed by the read path once the transaction
> completes.
> 
> If the underlying I2C transfer fails, the completion callback is invoked
> with a non-zero status. In this case, the allocated work_data is not
> usable for producing RNG output and must not remain associated with the
> hwrng state.
> 
> Previously, the failure path only logged a warning but left the pointer
> state uncleared, which can result in subsequent read attempts observing
> stale state and interpreting it as valid completion data.
> 
> Fix this by freeing the pending work_data. The I2C transaction reports
> an error. This ensures that failed requests do not leave residual state
> behind that could be interpreted as valid RNG data on later reads.
> Clearing rng->priv is done at the subsequent call to nonblocking read.
> 
> Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator")
> Signed-off-by: Lothar Rubusch <l.rubusch at gmail.com>
> Assisted-by: Gemini:1.5 Pro [google]
> Reviewed-by: Thorsten Blum <thorsten.blum at linux.dev>
> ---
> v2 -> v3:
> - remove existing error-path cleanup behavior [`rng->priv = 0;`],
>   update commit msg
> - rebased
> 
> v1 -> v2:
> - reword commit message for clarity and precision
> - keep existing error-path cleanup behavior unchanged, update commit msg
> 
>  drivers/crypto/atmel-sha204a.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert at gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt