From patchwork Mon Dec 16 17:47:51 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 181761 Delivered-To: patch@linaro.org Received: by 2002:ac9:44c4:0:0:0:0:0 with SMTP id t4csp4621553och; Mon, 16 Dec 2019 09:57:51 -0800 (PST) X-Google-Smtp-Source: APXvYqwH9YpSP4pewotTOjP0L29joUbmyotTDRA7+zuFy7+0usR2Mi9RWSsFIkR2yXbivyUXq714 X-Received: by 2002:a9d:74d8:: with SMTP id a24mr35095222otl.100.1576519071561; Mon, 16 Dec 2019 09:57:51 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1576519071; cv=none; d=google.com; s=arc-20160816; b=ukBePjgzdqzZZUAg5zPaMw1sOcZLCRpx0ZtOhlVzmGXNC1mfatneCKiizselWxaYjh unFfVlUrltRfZpj4ka6MEllo6xAgl6EXEd73KZuTOo0s5aCX0YRmqVO9nXuIgWP0qOI3 TlPLPexx5mWaFFOatErbBKdHlu6Sx5PcVMRANYQE0LN0M1hV48hQte2kWteoGgOXYVjc CzLIClzhwb9wPqGPI+oYnHPr6XLGvAr3/Pys99UoA9N6SbndiRF/AwwUxWBzJajg8/5s dC4ZEqpbHNcXkHcMHHamYLP9af6RwMAb3wQqefL5AfCu7PpTlC+ZAvjcUp5DmXsJ0zj5 vXKg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=dcsyXSb3xjV5yVlyG8XnUdZO+Xjjlf8E0WqhDS/CMW8=; b=M9KgsBAQehCQqMSvXvxIJxfDnUKY/yLy/jJy/ktqEYkc+b9uEFK/uNZPLjMbfk2IqB L/50GIQZC4JzMR+T2kwkeAXIxyr6I71cMz1TqbtRdG5N7AgMjrrPGIxK2Kqbk2r9/D13 czyIPQEAnKYNKK0tLdAbLRKrxYdoklmUvRmoC8qLdKbOvxwMU4Mfs8VRLpsEelKczenf E28E9PzJW2ytBlh6EHZRhexCnHOGL0l1HxOIY8cJ/7VvRbEAneEd5MgQOt5cbCoS3dlF EeFww0I/hijQyE4Lf/fHTdh2/64SqBzFo0GNU5YhbPXvefZzvg0PPB3PlX1I+jSVkZk0 vD3g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=haOIuDRE; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id i5si10422089oif.211.2019.12.16.09.57.51; Mon, 16 Dec 2019 09:57:51 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=haOIuDRE; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727377AbfLPR5u (ORCPT + 14 others); Mon, 16 Dec 2019 12:57:50 -0500 Received: from mail.kernel.org ([198.145.29.99]:57018 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726722AbfLPR5t (ORCPT ); Mon, 16 Dec 2019 12:57:49 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 374B5205ED; Mon, 16 Dec 2019 17:57:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1576519068; bh=DXDA4Lq4acHcggXVh/4++Hr9oR4iVnfHrAAnjEEAhiw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=haOIuDREjegheu1zlxMNs2WIPPfEGk/1LJub39lwbRAwU0CLjevF7NcJjdBetxrAp H5MajEz2aIy2vrYOwH4EXT527molyCsCq1ALo18l70BTOnLSowfhJhyCLAWBW67+Rv ETjlYCOLM1hP7Sldr4LTaCxDRlm4OZ9t7PvHbPh8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sahaj Sarup , Mark Salter , Gary R Hook , Herbert Xu Subject: [PATCH 4.14 145/267] crypto: ccp - fix uninitialized list head Date: Mon, 16 Dec 2019 18:47:51 +0100 Message-Id: <20191216174910.419981328@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20191216174848.701533383@linuxfoundation.org> References: <20191216174848.701533383@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mark Salter commit 691505a803a7f223b2af621848d581259c61f77d upstream. A NULL-pointer dereference was reported in fedora bz#1762199 while reshaping a raid6 array after adding a fifth drive to an existing array. [ 47.343549] md/raid:md0: raid level 6 active with 3 out of 5 devices, algorithm 2 [ 47.804017] md0: detected capacity change from 0 to 7885289422848 [ 47.822083] Unable to handle kernel read from unreadable memory at virtual address 0000000000000000 ... [ 47.940477] CPU: 1 PID: 14210 Comm: md0_raid6 Tainted: G W 5.2.18-200.fc30.aarch64 #1 [ 47.949594] Hardware name: AMD Overdrive/Supercharger/To be filled by O.E.M., BIOS ROD1002C 04/08/2016 [ 47.958886] pstate: 00400085 (nzcv daIf +PAN -UAO) [ 47.963668] pc : __list_del_entry_valid+0x2c/0xa8 [ 47.968366] lr : ccp_tx_submit+0x84/0x168 [ccp] [ 47.972882] sp : ffff00001369b970 [ 47.976184] x29: ffff00001369b970 x28: ffff00001369bdb8 [ 47.981483] x27: 00000000ffffffff x26: ffff8003b758af70 [ 47.986782] x25: ffff8003b758b2d8 x24: ffff8003e6245818 [ 47.992080] x23: 0000000000000000 x22: ffff8003e62450c0 [ 47.997379] x21: ffff8003dfd6add8 x20: 0000000000000003 [ 48.002678] x19: ffff8003e6245100 x18: 0000000000000000 [ 48.007976] x17: 0000000000000000 x16: 0000000000000000 [ 48.013274] x15: 0000000000000000 x14: 0000000000000000 [ 48.018572] x13: ffff7e000ef83a00 x12: 0000000000000001 [ 48.023870] x11: ffff000010eff998 x10: 00000000000019a0 [ 48.029169] x9 : 0000000000000000 x8 : ffff8003e6245180 [ 48.034467] x7 : 0000000000000000 x6 : 000000000000003f [ 48.039766] x5 : 0000000000000040 x4 : ffff8003e0145080 [ 48.045064] x3 : dead000000000200 x2 : 0000000000000000 [ 48.050362] x1 : 0000000000000000 x0 : ffff8003e62450c0 [ 48.055660] Call trace: [ 48.058095] __list_del_entry_valid+0x2c/0xa8 [ 48.062442] ccp_tx_submit+0x84/0x168 [ccp] [ 48.066615] async_tx_submit+0x224/0x368 [async_tx] [ 48.071480] async_trigger_callback+0x68/0xfc [async_tx] [ 48.076784] ops_run_biofill+0x178/0x1e8 [raid456] [ 48.081566] raid_run_ops+0x248/0x818 [raid456] [ 48.086086] handle_stripe+0x864/0x1208 [raid456] [ 48.090781] handle_active_stripes.isra.0+0xb0/0x278 [raid456] [ 48.096604] raid5d+0x378/0x618 [raid456] [ 48.100602] md_thread+0xa0/0x150 [ 48.103905] kthread+0x104/0x130 [ 48.107122] ret_from_fork+0x10/0x18 [ 48.110686] Code: d2804003 f2fbd5a3 eb03003f 54000320 (f9400021) [ 48.116766] ---[ end trace 23f390a527f7ad77 ]--- ccp_tx_submit is passed a dma_async_tx_descriptor which is contained in a ccp_dma_desc and adds it to a ccp channel's pending list: list_del(&desc->entry); list_add_tail(&desc->entry, &chan->pending); The problem is that desc->entry may be uninitialized in the async_trigger_callback path where the descriptor was gotten from ccp_prep_dma_interrupt which got it from ccp_alloc_dma_desc which doesn't initialize the desc->entry list head. So, just initialize the list head to avoid the problem. Cc: Reported-by: Sahaj Sarup Signed-off-by: Mark Salter Acked-by: Gary R Hook Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/ccp/ccp-dmaengine.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/crypto/ccp/ccp-dmaengine.c +++ b/drivers/crypto/ccp/ccp-dmaengine.c @@ -341,6 +341,7 @@ static struct ccp_dma_desc *ccp_alloc_dm desc->tx_desc.flags = flags; desc->tx_desc.tx_submit = ccp_tx_submit; desc->ccp = chan->ccp; + INIT_LIST_HEAD(&desc->entry); INIT_LIST_HEAD(&desc->pending); INIT_LIST_HEAD(&desc->active); desc->status = DMA_IN_PROGRESS;