forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers/crypto
History
Mark Salter be7993dd8e crypto: ccp - fix uninitialized list head 
commit 691505a803 upstream.

A NULL-pointer dereference was reported in fedora bz#1762199 while
reshaping a raid6 array after adding a fifth drive to an existing
array.

[   47.343549] md/raid:md0: raid level 6 active with 3 out of 5 devices, algorithm 2
[   47.804017] md0: detected capacity change from 0 to 7885289422848
[   47.822083] Unable to handle kernel read from unreadable memory at virtual address 0000000000000000
...
[   47.940477] CPU: 1 PID: 14210 Comm: md0_raid6 Tainted: G        W         5.2.18-200.fc30.aarch64 #1
[   47.949594] Hardware name: AMD Overdrive/Supercharger/To be filled by O.E.M., BIOS ROD1002C 04/08/2016
[   47.958886] pstate: 00400085 (nzcv daIf +PAN -UAO)
[   47.963668] pc : __list_del_entry_valid+0x2c/0xa8
[   47.968366] lr : ccp_tx_submit+0x84/0x168 [ccp]
[   47.972882] sp : ffff00001369b970
[   47.976184] x29: ffff00001369b970 x28: ffff00001369bdb8
[   47.981483] x27: 00000000ffffffff x26: ffff8003b758af70
[   47.986782] x25: ffff8003b758b2d8 x24: ffff8003e6245818
[   47.992080] x23: 0000000000000000 x22: ffff8003e62450c0
[   47.997379] x21: ffff8003dfd6add8 x20: 0000000000000003
[   48.002678] x19: ffff8003e6245100 x18: 0000000000000000
[   48.007976] x17: 0000000000000000 x16: 0000000000000000
[   48.013274] x15: 0000000000000000 x14: 0000000000000000
[   48.018572] x13: ffff7e000ef83a00 x12: 0000000000000001
[   48.023870] x11: ffff000010eff998 x10: 00000000000019a0
[   48.029169] x9 : 0000000000000000 x8 : ffff8003e6245180
[   48.034467] x7 : 0000000000000000 x6 : 000000000000003f
[   48.039766] x5 : 0000000000000040 x4 : ffff8003e0145080
[   48.045064] x3 : dead000000000200 x2 : 0000000000000000
[   48.050362] x1 : 0000000000000000 x0 : ffff8003e62450c0
[   48.055660] Call trace:
[   48.058095]  __list_del_entry_valid+0x2c/0xa8
[   48.062442]  ccp_tx_submit+0x84/0x168 [ccp]
[   48.066615]  async_tx_submit+0x224/0x368 [async_tx]
[   48.071480]  async_trigger_callback+0x68/0xfc [async_tx]
[   48.076784]  ops_run_biofill+0x178/0x1e8 [raid456]
[   48.081566]  raid_run_ops+0x248/0x818 [raid456]
[   48.086086]  handle_stripe+0x864/0x1208 [raid456]
[   48.090781]  handle_active_stripes.isra.0+0xb0/0x278 [raid456]
[   48.096604]  raid5d+0x378/0x618 [raid456]
[   48.100602]  md_thread+0xa0/0x150
[   48.103905]  kthread+0x104/0x130
[   48.107122]  ret_from_fork+0x10/0x18
[   48.110686] Code: d2804003 f2fbd5a3 eb03003f 54000320 (f9400021)
[   48.116766] ---[ end trace 23f390a527f7ad77 ]---

ccp_tx_submit is passed a dma_async_tx_descriptor which is contained in
a ccp_dma_desc and adds it to a ccp channel's pending list:

	list_del(&desc->entry);
	list_add_tail(&desc->entry, &chan->pending);

The problem is that desc->entry may be uninitialized in the
async_trigger_callback path where the descriptor was gotten
from ccp_prep_dma_interrupt which got it from ccp_alloc_dma_desc
which doesn't initialize the desc->entry list head. So, just
initialize the list head to avoid the problem.

Cc: <stable@vger.kernel.org>
Reported-by: Sahaj Sarup <sahajsarup@gmail.com>
Signed-off-by: Mark Salter <msalter@redhat.com>
Acked-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-13 08:52:47 +01:00
..
amcc crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr 2019-12-13 08:52:46 +01:00
axis crypto: axis - fix for recursive locking from bottom half 2019-04-20 09:16:04 +02:00
bcm crypto: bcm - fix normal/non key hash algorithm failure 2019-12-13 08:51:25 +01:00
caam crypto: caam - fix concurrency issue in givencrypt descriptor 2019-10-11 18:20:54 +02:00
cavium crypto: cavium/zip - Add missing single_release() 2019-10-11 18:20:53 +02:00
ccp crypto: ccp - fix uninitialized list head 2019-12-13 08:52:47 +01:00
ccree crypto: ccree - avoid implicit enum conversion 2019-12-01 09:16:28 +01:00
chelsio crypto/chelsio/chtls: listen fails with multiadapt 2019-12-05 09:20:18 +01:00
hisilicon crypto: hisilicon - Fix double free in sec_free_hw_sgl() 2019-10-07 18:57:16 +02:00
inside-secure crypto: inside-secure - do not rely on the hardware last bit for result descriptors 2019-07-26 09:14:04 +02:00
marvell crypto: remove redundant type flags from tfm allocation 2018-07-09 00:30:29 +08:00
mediatek headers: separate linux/mod_devicetable.h from linux/platform_device.h 2018-07-07 17:52:26 +02:00
nx crypto/NX: Set receive window credits to max number of CRBs in RxFIFO 2019-07-21 09:03:16 +02:00
qat crypto: qat - Silence smp_processor_id() warning 2019-10-11 18:20:52 +02:00
qce Char/Misc driver patches for 4.19-rc1 2018-08-18 11:04:51 -07:00
rockchip crypto: rockchip - update IV buffer to contain the next IV 2019-05-22 07:37:37 +02:00
stm32 crypto: stm32/hash - Fix hmac issue more than 256 bytes 2019-12-05 09:21:34 +01:00
sunxi-ss crypto: sun4i-ss - Fix invalid calculation of hash end 2019-05-31 06:46:15 -07:00
ux500 crypto: ux500 - Use proper enum in hash_set_dma_transfer 2019-02-12 19:47:17 +01:00
virtio Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2018-08-15 16:01:47 -07:00
vmx crypto: vmx - ghash: do nosimd fallback manually 2019-06-04 08:02:34 +02:00
atmel-aes-regs.h
atmel-aes.c crypto: atmel-aes - Fix IV handling when req->nbytes < ivsize 2019-12-13 08:52:46 +01:00
atmel-authenc.h
atmel-ecc.c crypto: atmel-ecc - remove overly verbose dev_info 2018-06-22 23:03:08 +08:00
atmel-ecc.h
atmel-sha-regs.h
atmel-sha.c crypto: remove redundant type flags from tfm allocation 2018-07-09 00:30:29 +08:00
atmel-tdes-regs.h
atmel-tdes.c crypto: atmel - Delete error messages for a failed memory allocation in six functions 2018-02-22 22:17:00 +08:00
exynos-rng.c crypto: drivers - simplify getting .drvdata 2018-04-28 16:09:35 +08:00
geode-aes.c
geode-aes.h
hifn_795x.c crypto: hifn_795x - Fix a memory leak in the error handling path of 'hifn_probe()' 2017-11-29 17:33:30 +11:00
img-hash.c
ixp4xx_crypto.c crypto: ixp4xx - don't leak pointers to authenc keys 2018-03-31 01:33:12 +08:00
Kconfig crypto: bcm - convert to use crypto_authenc_extractkeys() 2019-01-22 21:40:31 +01:00
Makefile crypto: hisilicon - SEC security accelerator driver 2018-08-03 18:06:02 +08:00
mxc-scc.c crypto: mxc-scc - fix build warnings on ARM64 2019-12-05 09:20:49 +01:00
mxs-dcp.c crypto: mxs-dcp - Fix AES issues 2019-11-24 08:20:31 +01:00
n2_asm.S
n2_core.c crypto: ahash - remove useless setting of type flags 2018-07-09 00:30:25 +08:00
n2_core.h
omap-aes-gcm.c
omap-aes.c crypto: omap-aes - make queue length configurable 2018-03-09 22:45:39 +08:00
omap-aes.h crypto: omap - convert to new crypto engine API 2018-02-15 23:26:51 +08:00
omap-crypto.c crypto: omap-crypto - Verify page zone scatterlists before starting DMA 2018-03-09 22:45:36 +08:00
omap-crypto.h
omap-des.c crypto: omap - convert to new crypto engine API 2018-02-15 23:26:51 +08:00
omap-sham.c crypto: ahash - remove useless setting of type flags 2018-07-09 00:30:25 +08:00
padlock-aes.c crypto: padlock-aes - Fix Nano workaround data corruption 2018-07-20 13:47:42 +08:00
padlock-sha.c crypto: shash - remove useless setting of type flags 2018-07-09 00:30:24 +08:00
picoxcell_crypto.c crypto: drivers - simplify getting .drvdata 2018-04-28 16:09:35 +08:00
picoxcell_crypto_regs.h
qcom-rng.c crypto: qcom-rng - Add ACPI support 2018-07-27 19:04:32 +08:00
s5p-sss.c crypto: s5p-sss: Fix Fix argument list alignment 2019-11-20 18:47:43 +01:00
sahara.c crypto: sharah - Unregister correct algorithms for SAHARA 3 2018-07-20 13:51:22 +08:00
talitos.c crypto: talitos - fix missing break in switch statement 2019-10-01 08:26:02 +02:00
talitos.h crypto: talitos - move struct talitos_edesc into talitos.h 2019-07-21 09:03:15 +02:00