From: Heiko Carstens <heiko.carstens@de.ibm.com>
To: Stephen Rothwell <sfr@canb.auug.org.au>,
Herbert Xu <herbert@gondor.apana.org.au>,
Jan Glauber <jang@linux.vnet.ibm.com>
Cc: linux-next@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
Martin Schwidefsky <schwidefsky@de.ibm.com>
Subject: Re: linux-next: Tree for March 20 - crypto crash on s390
Date: Fri, 20 Mar 2009 13:59:12 +0100 [thread overview]
Message-ID: <20090320135912.53147d76@osiris.boeblingen.de.ibm.com> (raw)
In-Reply-To: <20090320162800.24b0ad93.sfr@canb.auug.org.au>
I get the crash below when I compile hardware support for SHA512
(CONFIG_CRYPTO_SHA512_S390=y) into the kernel:
Unable to handle kernel pointer dereference at virtual kernel address 000000003f9b0000
Oops: 0011 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Modules linked in:
CPU: 1 Not tainted 2.6.29-rc8-next-20090320-dirty #18
Process cryptomgr_test (pid: 169, task: 000000003f8326a0, ksp: 000000003fb83d78)
Krnl PSW : 0704000180000000 0000000000032b80 (s390_sha_final+0x198/0x1d4)
R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:0 PM:0 EA:3
Krnl GPRS: 0000000000000003 00000000fffffff3 000000003f9affa4 0000000000fffffc
0000000000000080 0000000000000003 0000000000000000 000000003fb83d98
000000000060a6f0 000000003f9afc48 0000000000000000 000000003fb83b50
000000003f9afc58 0000000000403fb8 00000000001c4152 000000003fb83b50
Krnl Code: 0000000000032b76: a7f4ff60 brc 15,32a36
0000000000032b7a: 1843 lr %rr4,%rr3
0000000000032b7c: a7f4ffbb brc 15,32af2
>0000000000032b80: d7ff20002000 xc 0(256,%rr2),0(%rr2)
0000000000032b86: 41202100 la %rr2,256(%rr2)
0000000000032b8a: a737fffb brctg %rr3,32b80
0000000000032b8e: a7f4ff83 brc 15,32a94
0000000000032b92: d2ff30002000 mvc 0(256,%rr3),0(%rr2)
Call Trace:
([<000000003fb83c40>] 0x3fb83c40)
[<00000000001c4152>] crypto_shash_final+0x46/0x70
[<00000000001c41f4>] shash_async_final+0x34/0x48
[<00000000001c47ce>] shash_async_digest+0x12a/0x158
[<00000000001c615e>] alg_test_hash+0x1ae/0x634
[<00000000001c802e>] alg_test+0xa2/0x210
[<00000000001c51d8>] cryptomgr_test+0x6c/0x70
[<0000000000067d4a>] kthread+0x76/0xbc
[<000000000001befa>] kernel_thread_starter+0x6/0xc
[<000000000001bef4>] kernel_thread_starter+0x0/0xc
Last Breaking-Event-Address:
[<0000000000032b8a>] s390_sha_final+0x1a2/0x1d4
<4>---[ end trace 561bb236c800851f ]---
The problem here seems to be that
int s390_sha_final(struct shash_desc *desc, u8 *out)
gets called with an shash_desc where
bsize = crypto_shash_blocksize(desc->tfm);
results in bsize with zero.
Later in s390_sha_final we see this:
/* pad with zeros */
memset(ctx->buf + index, 0x00, end - index - 8);
because of bsize being zero the result of "end - index -8" is -12.
Obviously it isn't a very good thing to pass a length of -12 to memset.
I have no idea where the bug is: either the s390 arch specific part is
broken because it cannot handle zero sized block sizes or the common
code is broken because it even calls this function with a size of zero.
Jan, Herbert?
next prev parent reply other threads:[~2009-03-20 12:59 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-03-20 5:28 linux-next: Tree for March 20 Stephen Rothwell
2009-03-20 9:05 ` Next March 20 : drivers/md/dm-exception-store build break Sachin Sant
2009-03-20 9:09 ` linux-next: Tree for March 20 - timeriomem build break on s390 Heiko Carstens
2009-03-21 6:19 ` Herbert Xu
2009-03-21 10:38 ` Alexander Clouter
2009-03-20 9:14 ` linux-next: Tree for March 20 - dnet " Heiko Carstens
2009-03-20 11:06 ` [PATCH] dnet: DNET should depend on HAS_IOMEM Ilya Yanok
2009-03-21 23:58 ` David Miller
2009-03-20 12:59 ` Heiko Carstens [this message]
2009-03-21 6:26 ` linux-next: Tree for March 20 - crypto crash on s390 Herbert Xu
2009-03-21 10:56 ` Heiko Carstens
2009-03-21 13:13 ` Herbert Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20090320135912.53147d76@osiris.boeblingen.de.ibm.com \
--to=heiko.carstens@de.ibm.com \
--cc=herbert@gondor.apana.org.au \
--cc=jang@linux.vnet.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-next@vger.kernel.org \
--cc=schwidefsky@de.ibm.com \
--cc=sfr@canb.auug.org.au \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).