From patchwork Thu Dec 19 18:32:49 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 182171 Delivered-To: patch@linaro.org Received: by 2002:a92:d0a:0:0:0:0:0 with SMTP id 10csp861643iln; Thu, 19 Dec 2019 10:46:48 -0800 (PST) X-Google-Smtp-Source: APXvYqz9NCwMAThONiilp1pc2PEyakzNVf+BgA4alS3TW/dKYgpCovwc2eop+RPp5e5A9SiN0lex X-Received: by 2002:a05:6830:145:: with SMTP id j5mr9813524otp.242.1576781208132; Thu, 19 Dec 2019 10:46:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1576781208; cv=none; d=google.com; s=arc-20160816; b=lt28xffGqEooDJ16LmGASSj1cqF1CoNxGn2qM6k4QpdTiqQJVOGlxBaQaERokfFRel Z39uoIyKUcD/g5IYBjaEuP19UaKUI7lRPT3T/Hko36T6Giz37HILUqUelZNy24fCpL7L iFG5g7kL81g1gSlQWlYKwf6MeCVggm/4ngISknWn1kxESa6IrFuBjCQfOzvZPQVpzk5A 0IDjun61yIjZVkJOAUusOVYaPbfEAG1pY+dg+uKZoHd0/4uJZoAA8DIhJRtUT2QomsVD 3AGnP29aWSgvHuGKYPbzNAz1Cuq84EUEKbeF22MNfd3+F7sVgcytTV1On0tbttSnmWOG O6AQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=pCsLEg7E3yWdz0oy6N8DbyI602VlaIKCEGwZcGqlAEY=; b=v4cUGO8NiGpkbteyHzy2LZk3sT/sz14qP7nzc4L7QCLZFDkuUit8RoicvOK6+lku+K CEVdEds8lcC0HdOpQ3pJpK0AUzXmfrN4zbpUt9wZnAHgFSOi3ZJbmcB4dfl1uAKHCgZa V/b9J043x0xHaxHe3SexCziQYa17bxp9rSCgFvt3lFTZMMoFYMbOmrp92CbIyRy04YWp tm0s0ynJ7dBT9RlDszIt8/DhyeP/ZfG4F6G19iR6L6gD28EdDHrFQWOxpY+vm+a1X5s/ 3L+RF+tD5b1OY4/PPDMpzttSXrmRtPYOAGqV40dKCiUIvYXkNpsxXxbFVoHaG3jRXAFK 8hfA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="dz+p/x6/"; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 46si3662283otu.45.2019.12.19.10.46.47; Thu, 19 Dec 2019 10:46:48 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="dz+p/x6/"; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729373AbfLSSqq (ORCPT + 14 others); Thu, 19 Dec 2019 13:46:46 -0500 Received: from mail.kernel.org ([198.145.29.99]:39438 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729363AbfLSSqn (ORCPT ); Thu, 19 Dec 2019 13:46:43 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 643E124676; Thu, 19 Dec 2019 18:46:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1576781201; bh=5Q8ef8tjuHuf0kMqNot+Fh9TOq/CFHB91XyZiKLMHGM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dz+p/x6/P3XLYMUc1t/PiVXyOUkgz8hf/K2PGRM7L8jusRHTzBWAfBBsqHhbMai6M woXB4aBC6m3rFNbzGoxv11mK6efqsyXhstUrEIcjG0HgCH0aQY0zSJpTOBKbNmm8vG oKTW7sn12350uCthGJQpwFB03GsyuueKV3Fa6e+M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sahaj Sarup , Mark Salter , Gary R Hook , Herbert Xu Subject: [PATCH 4.9 087/199] crypto: ccp - fix uninitialized list head Date: Thu, 19 Dec 2019 19:32:49 +0100 Message-Id: <20191219183219.757570137@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20191219183214.629503389@linuxfoundation.org> References: <20191219183214.629503389@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mark Salter commit 691505a803a7f223b2af621848d581259c61f77d upstream. A NULL-pointer dereference was reported in fedora bz#1762199 while reshaping a raid6 array after adding a fifth drive to an existing array. [ 47.343549] md/raid:md0: raid level 6 active with 3 out of 5 devices, algorithm 2 [ 47.804017] md0: detected capacity change from 0 to 7885289422848 [ 47.822083] Unable to handle kernel read from unreadable memory at virtual address 0000000000000000 ... [ 47.940477] CPU: 1 PID: 14210 Comm: md0_raid6 Tainted: G W 5.2.18-200.fc30.aarch64 #1 [ 47.949594] Hardware name: AMD Overdrive/Supercharger/To be filled by O.E.M., BIOS ROD1002C 04/08/2016 [ 47.958886] pstate: 00400085 (nzcv daIf +PAN -UAO) [ 47.963668] pc : __list_del_entry_valid+0x2c/0xa8 [ 47.968366] lr : ccp_tx_submit+0x84/0x168 [ccp] [ 47.972882] sp : ffff00001369b970 [ 47.976184] x29: ffff00001369b970 x28: ffff00001369bdb8 [ 47.981483] x27: 00000000ffffffff x26: ffff8003b758af70 [ 47.986782] x25: ffff8003b758b2d8 x24: ffff8003e6245818 [ 47.992080] x23: 0000000000000000 x22: ffff8003e62450c0 [ 47.997379] x21: ffff8003dfd6add8 x20: 0000000000000003 [ 48.002678] x19: ffff8003e6245100 x18: 0000000000000000 [ 48.007976] x17: 0000000000000000 x16: 0000000000000000 [ 48.013274] x15: 0000000000000000 x14: 0000000000000000 [ 48.018572] x13: ffff7e000ef83a00 x12: 0000000000000001 [ 48.023870] x11: ffff000010eff998 x10: 00000000000019a0 [ 48.029169] x9 : 0000000000000000 x8 : ffff8003e6245180 [ 48.034467] x7 : 0000000000000000 x6 : 000000000000003f [ 48.039766] x5 : 0000000000000040 x4 : ffff8003e0145080 [ 48.045064] x3 : dead000000000200 x2 : 0000000000000000 [ 48.050362] x1 : 0000000000000000 x0 : ffff8003e62450c0 [ 48.055660] Call trace: [ 48.058095] __list_del_entry_valid+0x2c/0xa8 [ 48.062442] ccp_tx_submit+0x84/0x168 [ccp] [ 48.066615] async_tx_submit+0x224/0x368 [async_tx] [ 48.071480] async_trigger_callback+0x68/0xfc [async_tx] [ 48.076784] ops_run_biofill+0x178/0x1e8 [raid456] [ 48.081566] raid_run_ops+0x248/0x818 [raid456] [ 48.086086] handle_stripe+0x864/0x1208 [raid456] [ 48.090781] handle_active_stripes.isra.0+0xb0/0x278 [raid456] [ 48.096604] raid5d+0x378/0x618 [raid456] [ 48.100602] md_thread+0xa0/0x150 [ 48.103905] kthread+0x104/0x130 [ 48.107122] ret_from_fork+0x10/0x18 [ 48.110686] Code: d2804003 f2fbd5a3 eb03003f 54000320 (f9400021) [ 48.116766] ---[ end trace 23f390a527f7ad77 ]--- ccp_tx_submit is passed a dma_async_tx_descriptor which is contained in a ccp_dma_desc and adds it to a ccp channel's pending list: list_del(&desc->entry); list_add_tail(&desc->entry, &chan->pending); The problem is that desc->entry may be uninitialized in the async_trigger_callback path where the descriptor was gotten from ccp_prep_dma_interrupt which got it from ccp_alloc_dma_desc which doesn't initialize the desc->entry list head. So, just initialize the list head to avoid the problem. Cc: Reported-by: Sahaj Sarup Signed-off-by: Mark Salter Acked-by: Gary R Hook Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/ccp/ccp-dmaengine.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/crypto/ccp/ccp-dmaengine.c +++ b/drivers/crypto/ccp/ccp-dmaengine.c @@ -309,6 +309,7 @@ static struct ccp_dma_desc *ccp_alloc_dm desc->tx_desc.flags = flags; desc->tx_desc.tx_submit = ccp_tx_submit; desc->ccp = chan->ccp; + INIT_LIST_HEAD(&desc->entry); INIT_LIST_HEAD(&desc->pending); INIT_LIST_HEAD(&desc->active); desc->status = DMA_IN_PROGRESS;