forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers/crypto/ccp
History
Mark Salter be7993dd8e crypto: ccp - fix uninitialized list head 
commit 691505a803 upstream.

A NULL-pointer dereference was reported in fedora bz#1762199 while
reshaping a raid6 array after adding a fifth drive to an existing
array.

[   47.343549] md/raid:md0: raid level 6 active with 3 out of 5 devices, algorithm 2
[   47.804017] md0: detected capacity change from 0 to 7885289422848
[   47.822083] Unable to handle kernel read from unreadable memory at virtual address 0000000000000000
...
[   47.940477] CPU: 1 PID: 14210 Comm: md0_raid6 Tainted: G        W         5.2.18-200.fc30.aarch64 #1
[   47.949594] Hardware name: AMD Overdrive/Supercharger/To be filled by O.E.M., BIOS ROD1002C 04/08/2016
[   47.958886] pstate: 00400085 (nzcv daIf +PAN -UAO)
[   47.963668] pc : __list_del_entry_valid+0x2c/0xa8
[   47.968366] lr : ccp_tx_submit+0x84/0x168 [ccp]
[   47.972882] sp : ffff00001369b970
[   47.976184] x29: ffff00001369b970 x28: ffff00001369bdb8
[   47.981483] x27: 00000000ffffffff x26: ffff8003b758af70
[   47.986782] x25: ffff8003b758b2d8 x24: ffff8003e6245818
[   47.992080] x23: 0000000000000000 x22: ffff8003e62450c0
[   47.997379] x21: ffff8003dfd6add8 x20: 0000000000000003
[   48.002678] x19: ffff8003e6245100 x18: 0000000000000000
[   48.007976] x17: 0000000000000000 x16: 0000000000000000
[   48.013274] x15: 0000000000000000 x14: 0000000000000000
[   48.018572] x13: ffff7e000ef83a00 x12: 0000000000000001
[   48.023870] x11: ffff000010eff998 x10: 00000000000019a0
[   48.029169] x9 : 0000000000000000 x8 : ffff8003e6245180
[   48.034467] x7 : 0000000000000000 x6 : 000000000000003f
[   48.039766] x5 : 0000000000000040 x4 : ffff8003e0145080
[   48.045064] x3 : dead000000000200 x2 : 0000000000000000
[   48.050362] x1 : 0000000000000000 x0 : ffff8003e62450c0
[   48.055660] Call trace:
[   48.058095]  __list_del_entry_valid+0x2c/0xa8
[   48.062442]  ccp_tx_submit+0x84/0x168 [ccp]
[   48.066615]  async_tx_submit+0x224/0x368 [async_tx]
[   48.071480]  async_trigger_callback+0x68/0xfc [async_tx]
[   48.076784]  ops_run_biofill+0x178/0x1e8 [raid456]
[   48.081566]  raid_run_ops+0x248/0x818 [raid456]
[   48.086086]  handle_stripe+0x864/0x1208 [raid456]
[   48.090781]  handle_active_stripes.isra.0+0xb0/0x278 [raid456]
[   48.096604]  raid5d+0x378/0x618 [raid456]
[   48.100602]  md_thread+0xa0/0x150
[   48.103905]  kthread+0x104/0x130
[   48.107122]  ret_from_fork+0x10/0x18
[   48.110686] Code: d2804003 f2fbd5a3 eb03003f 54000320 (f9400021)
[   48.116766] ---[ end trace 23f390a527f7ad77 ]---

ccp_tx_submit is passed a dma_async_tx_descriptor which is contained in
a ccp_dma_desc and adds it to a ccp channel's pending list:

	list_del(&desc->entry);
	list_add_tail(&desc->entry, &chan->pending);

The problem is that desc->entry may be uninitialized in the
async_trigger_callback path where the descriptor was gotten
from ccp_prep_dma_interrupt which got it from ccp_alloc_dma_desc
which doesn't initialize the desc->entry list head. So, just
initialize the list head to avoid the problem.

Cc: <stable@vger.kernel.org>
Reported-by: Sahaj Sarup <sahajsarup@gmail.com>
Signed-off-by: Mark Salter <msalter@redhat.com>
Acked-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-13 08:52:47 +01:00
..
ccp-crypto-aes-cmac.c crypto: ahash - remove useless setting of cra_type 2018-07-09 00:30:26 +08:00
ccp-crypto-aes-galois.c crypto: ccp - Add support for valid authsize values less than 16 2019-08-16 10:12:38 +02:00
ccp-crypto-aes-xts.c crypto: ccp - Add XTS-AES-256 support for CCP version 5 2017-08-04 09:27:44 +08:00
ccp-crypto-aes.c
ccp-crypto-des3.c crypto: ccp - Update copyright dates for 2017. 2017-07-28 17:58:01 +08:00
ccp-crypto-main.c crypto: ccp - use -ENOSPC for transient busy indication 2017-11-03 22:11:16 +08:00
ccp-crypto-rsa.c crypto: ccp - return an actual key size from RSA max_size callback 2018-03-03 00:03:41 +08:00
ccp-crypto-sha.c crypto: ahash - remove useless setting of cra_type 2018-07-09 00:30:26 +08:00
ccp-crypto.h crypto: ccp - Add XTS-AES-256 support for CCP version 5 2017-08-04 09:27:44 +08:00
ccp-debugfs.c crypto: ccp - don't disable interrupts while setting up debugfs 2018-03-03 00:03:40 +08:00
ccp-dev-v3.c csrypto: ccp - Expand RSA support for a v5 ccp 2017-07-28 17:58:06 +08:00
ccp-dev-v5.c crypto: ccp - remove unused variable qim 2017-11-03 21:53:30 +08:00
ccp-dev.c crypto: ccp - Ignore unconfigured CCP device on suspend/resume 2019-09-06 10:22:21 +02:00
ccp-dev.h crypto: ccp - Validate the the error value used to index error messages 2019-07-26 09:14:19 +02:00
ccp-dmaengine.c crypto: ccp - fix uninitialized list head 2019-12-13 08:52:47 +01:00
ccp-ops.c crypto: ccp - Ignore tag length when decrypting GCM ciphertext 2019-08-16 10:12:38 +02:00
Kconfig crypto: ccp: Add Platform Security Processor (PSP) device support 2017-12-04 10:57:28 -06:00
Makefile crypto: ccp: Add Platform Security Processor (PSP) device support 2017-12-04 10:57:28 -06:00
psp-dev.c crypto: ccp - Do not free psp_master when PLATFORM_INIT fails 2019-05-22 07:37:36 +02:00
psp-dev.h crypto: ccp - Support register differences between PSP devices 2018-07-13 18:26:48 +08:00
sp-dev.c crypto: ccp - add check to get PSP master only when PSP is detected 2018-03-03 00:03:39 +08:00
sp-dev.h crypto: ccp - Support register differences between PSP devices 2018-07-13 18:26:48 +08:00
sp-pci.c crypto: ccp - Add support for new CCP/PSP device ID 2018-07-13 18:26:48 +08:00
sp-platform.c crypto: ccp - rename ccp driver initialize files as sp device 2017-07-18 18:15:54 +08:00