From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Daniel Jordan <daniel.m.jordan@oracle.com>
Cc: Sasha Levin <sashal@kernel.org>,
Yang Yingliang <yangyingliang@huawei.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
Steffen Klassert <steffen.klassert@secunet.com>,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH for 4.19-stable] padata: fix null pointer deref of pd->pinst
Date: Fri, 14 Feb 2020 16:17:18 -0500 [thread overview]
Message-ID: <20200214211718.GD4087988@kroah.com> (raw)
In-Reply-To: <20200214182821.337706-1-daniel.m.jordan@oracle.com>
On Fri, Feb 14, 2020 at 01:28:21PM -0500, Daniel Jordan wrote:
> The 4.19 backport dc34710a7aba ("padata: Remove broken queue flushing")
> removed padata_alloc_pd()'s assignment to pd->pinst, resulting in:
>
> Unable to handle kernel NULL pointer dereference ...
> ...
> pc : padata_reorder+0x144/0x2e0
> ...
> Call trace:
> padata_reorder+0x144/0x2e0
> padata_do_serial+0xc8/0x128
> pcrypt_aead_enc+0x60/0x70 [pcrypt]
> padata_parallel_worker+0xd8/0x138
> process_one_work+0x1bc/0x4b8
> worker_thread+0x164/0x580
> kthread+0x134/0x138
> ret_from_fork+0x10/0x18
>
> This happened because the backport was based on an enhancement that
> moved this assignment but isn't in 4.19:
>
> bfde23ce200e ("padata: unbind parallel jobs from specific CPUs")
>
> Simply restore the assignment to fix the crash.
>
> Fixes: dc34710a7aba ("padata: Remove broken queue flushing")
> Reported-by: Yang Yingliang <yangyingliang@huawei.com>
> Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Herbert Xu <herbert@gondor.apana.org.au>
> Cc: Sasha Levin <sashal@kernel.org>
> Cc: Steffen Klassert <steffen.klassert@secunet.com>
> Cc: linux-kernel@vger.kernel.org
> Cc: stable@vger.kernel.org
> ---
> kernel/padata.c | 1 +
> 1 file changed, 1 insertion(+)
Thanks for this, now queued up.
greg k-h
next prev parent reply other threads:[~2020-02-14 21:18 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-14 18:28 [PATCH for 4.19-stable] padata: fix null pointer deref of pd->pinst Daniel Jordan
2020-02-14 21:17 ` Greg Kroah-Hartman [this message]
2020-02-15 15:01 ` Sasha Levin
2020-02-17 2:11 ` Yang Yingliang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200214211718.GD4087988@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=daniel.m.jordan@oracle.com \
--cc=herbert@gondor.apana.org.au \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.