From patchwork Wed Dec 11 15:06:03 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 181226 Delivered-To: patch@linaro.org Received: by 2002:a92:3001:0:0:0:0:0 with SMTP id x1csp659818ile; Wed, 11 Dec 2019 07:10:10 -0800 (PST) X-Google-Smtp-Source: APXvYqxyDYZUQWy+Qa/CY52ff2YioVHPDxrKhNzJxuG/STcuQ4HsX2B3RcVCZ8UEaZQ36yoPEZ9b X-Received: by 2002:a9d:6c81:: with SMTP id c1mr2687707otr.39.1576077009817; Wed, 11 Dec 2019 07:10:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1576077009; cv=none; d=google.com; s=arc-20160816; b=tSSW2MrPCfyYNlsOwpSACwpaH2tdJLNIehiZiNTNYbZdEKjmf9xKUdOB0W4WfRWlC6 sUZE7HAY+OAWKkzlup4apuZ1IODrHgux/8XBeQpw+D0d7aV+AjlKaaOeVJA6G7FTAh+i MrC81c4/YguP/EHox6HHmda99lXJK4cm4lnI2KKu1NCeUoMd/YycJZiup64kH3UEzRe/ jM3nI9a3tluh+YH1jPYuB5iMnu4fXLZe8YSU4ItQNY+xEZY3FlLnbUMeMXB1Q40hBsQ6 BLnlaK84El3bLm7kxMmLg+fFM/WMtNy1LjspADRyz3yDGfZXPIgpSUaCfWUCKSA+2XkJ adPQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=jbK8Abt5JmVgbWQVT5JXjXGAoTSfvosl++JW1Rzf1bg=; b=c0JeYnDkO1sqSnNlPIAQIk1QoFDIo9wmd04QQlUAc8t+bnZCu0C3qq/3MIe096hWCA xvAsaTrBIP7hZOv17hD/9PrfH/hMLPGTGaUArM6YX8HxIPMouIiKj3S29SH/rIUNcIJR 5cCOoNmoHNecGWK8pfmnSiwuGUbKflrzVPAWZekdokX5yxU/YzQLhP01WkG41QmeQHSE l0tSbZUK5zzvMRzBuk1PdnpgSCOYDUlc6CwJMNY8U66+7rhwX3Bm8YMSs/OnnYFUctm7 658lOOW6JrXcYLBPA/xbrXQLieaVrHbsXcUIPwh3BXRUSd3Ue1TI1QWwPm+xztuiBkE2 uT/Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=kYyykhgm; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v13si1222511oth.280.2019.12.11.07.10.09; Wed, 11 Dec 2019 07:10:09 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=kYyykhgm; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730372AbfLKPKI (ORCPT + 14 others); Wed, 11 Dec 2019 10:10:08 -0500 Received: from mail.kernel.org ([198.145.29.99]:58274 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730693AbfLKPKH (ORCPT ); Wed, 11 Dec 2019 10:10:07 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0C75B208C3; Wed, 11 Dec 2019 15:10:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1576077006; bh=JRrpzkB/a7B0JHphgR8484dsj6bgcvGmKDUVBV18vGo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kYyykhgmge2yd9AmBIkhmLS04xXoHXLh1b3AR5vR0AGI5S5nO0hSFzRk9HDP0J5IQ 46jPcXLYZi+SvZPiUxiwBelshxvIlE9X0Qvp9lZAryqoOOavIpvGuM06xAKx6BT+n+ dodTSAjt4A74fEp4b33qkypFLeDIF6LEIQ3IiwzE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sahaj Sarup , Mark Salter , Gary R Hook , Herbert Xu Subject: [PATCH 5.4 72/92] crypto: ccp - fix uninitialized list head Date: Wed, 11 Dec 2019 16:06:03 +0100 Message-Id: <20191211150257.225734522@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20191211150221.977775294@linuxfoundation.org> References: <20191211150221.977775294@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mark Salter commit 691505a803a7f223b2af621848d581259c61f77d upstream. A NULL-pointer dereference was reported in fedora bz#1762199 while reshaping a raid6 array after adding a fifth drive to an existing array. [ 47.343549] md/raid:md0: raid level 6 active with 3 out of 5 devices, algorithm 2 [ 47.804017] md0: detected capacity change from 0 to 7885289422848 [ 47.822083] Unable to handle kernel read from unreadable memory at virtual address 0000000000000000 ... [ 47.940477] CPU: 1 PID: 14210 Comm: md0_raid6 Tainted: G W 5.2.18-200.fc30.aarch64 #1 [ 47.949594] Hardware name: AMD Overdrive/Supercharger/To be filled by O.E.M., BIOS ROD1002C 04/08/2016 [ 47.958886] pstate: 00400085 (nzcv daIf +PAN -UAO) [ 47.963668] pc : __list_del_entry_valid+0x2c/0xa8 [ 47.968366] lr : ccp_tx_submit+0x84/0x168 [ccp] [ 47.972882] sp : ffff00001369b970 [ 47.976184] x29: ffff00001369b970 x28: ffff00001369bdb8 [ 47.981483] x27: 00000000ffffffff x26: ffff8003b758af70 [ 47.986782] x25: ffff8003b758b2d8 x24: ffff8003e6245818 [ 47.992080] x23: 0000000000000000 x22: ffff8003e62450c0 [ 47.997379] x21: ffff8003dfd6add8 x20: 0000000000000003 [ 48.002678] x19: ffff8003e6245100 x18: 0000000000000000 [ 48.007976] x17: 0000000000000000 x16: 0000000000000000 [ 48.013274] x15: 0000000000000000 x14: 0000000000000000 [ 48.018572] x13: ffff7e000ef83a00 x12: 0000000000000001 [ 48.023870] x11: ffff000010eff998 x10: 00000000000019a0 [ 48.029169] x9 : 0000000000000000 x8 : ffff8003e6245180 [ 48.034467] x7 : 0000000000000000 x6 : 000000000000003f [ 48.039766] x5 : 0000000000000040 x4 : ffff8003e0145080 [ 48.045064] x3 : dead000000000200 x2 : 0000000000000000 [ 48.050362] x1 : 0000000000000000 x0 : ffff8003e62450c0 [ 48.055660] Call trace: [ 48.058095] __list_del_entry_valid+0x2c/0xa8 [ 48.062442] ccp_tx_submit+0x84/0x168 [ccp] [ 48.066615] async_tx_submit+0x224/0x368 [async_tx] [ 48.071480] async_trigger_callback+0x68/0xfc [async_tx] [ 48.076784] ops_run_biofill+0x178/0x1e8 [raid456] [ 48.081566] raid_run_ops+0x248/0x818 [raid456] [ 48.086086] handle_stripe+0x864/0x1208 [raid456] [ 48.090781] handle_active_stripes.isra.0+0xb0/0x278 [raid456] [ 48.096604] raid5d+0x378/0x618 [raid456] [ 48.100602] md_thread+0xa0/0x150 [ 48.103905] kthread+0x104/0x130 [ 48.107122] ret_from_fork+0x10/0x18 [ 48.110686] Code: d2804003 f2fbd5a3 eb03003f 54000320 (f9400021) [ 48.116766] ---[ end trace 23f390a527f7ad77 ]--- ccp_tx_submit is passed a dma_async_tx_descriptor which is contained in a ccp_dma_desc and adds it to a ccp channel's pending list: list_del(&desc->entry); list_add_tail(&desc->entry, &chan->pending); The problem is that desc->entry may be uninitialized in the async_trigger_callback path where the descriptor was gotten from ccp_prep_dma_interrupt which got it from ccp_alloc_dma_desc which doesn't initialize the desc->entry list head. So, just initialize the list head to avoid the problem. Cc: Reported-by: Sahaj Sarup Signed-off-by: Mark Salter Acked-by: Gary R Hook Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/ccp/ccp-dmaengine.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/crypto/ccp/ccp-dmaengine.c +++ b/drivers/crypto/ccp/ccp-dmaengine.c @@ -342,6 +342,7 @@ static struct ccp_dma_desc *ccp_alloc_dm desc->tx_desc.flags = flags; desc->tx_desc.tx_submit = ccp_tx_submit; desc->ccp = chan->ccp; + INIT_LIST_HEAD(&desc->entry); INIT_LIST_HEAD(&desc->pending); INIT_LIST_HEAD(&desc->active); desc->status = DMA_IN_PROGRESS;