From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Sahaj Sarup <sahajsarup@gmail.com>,
Mark Salter <msalter@redhat.com>, Gary R Hook <gary.hook@amd.com>,
Herbert Xu <herbert@gondor.apana.org.au>
Subject: [PATCH 5.3 089/105] crypto: ccp - fix uninitialized list head
Date: Wed, 11 Dec 2019 16:06:18 +0100 [thread overview]
Message-ID: <20191211150300.377604506@linuxfoundation.org> (raw)
In-Reply-To: <20191211150221.153659747@linuxfoundation.org>
From: Mark Salter <msalter@redhat.com>
commit 691505a803a7f223b2af621848d581259c61f77d upstream.
A NULL-pointer dereference was reported in fedora bz#1762199 while
reshaping a raid6 array after adding a fifth drive to an existing
array.
[ 47.343549] md/raid:md0: raid level 6 active with 3 out of 5 devices, algorithm 2
[ 47.804017] md0: detected capacity change from 0 to 7885289422848
[ 47.822083] Unable to handle kernel read from unreadable memory at virtual address 0000000000000000
...
[ 47.940477] CPU: 1 PID: 14210 Comm: md0_raid6 Tainted: G W 5.2.18-200.fc30.aarch64 #1
[ 47.949594] Hardware name: AMD Overdrive/Supercharger/To be filled by O.E.M., BIOS ROD1002C 04/08/2016
[ 47.958886] pstate: 00400085 (nzcv daIf +PAN -UAO)
[ 47.963668] pc : __list_del_entry_valid+0x2c/0xa8
[ 47.968366] lr : ccp_tx_submit+0x84/0x168 [ccp]
[ 47.972882] sp : ffff00001369b970
[ 47.976184] x29: ffff00001369b970 x28: ffff00001369bdb8
[ 47.981483] x27: 00000000ffffffff x26: ffff8003b758af70
[ 47.986782] x25: ffff8003b758b2d8 x24: ffff8003e6245818
[ 47.992080] x23: 0000000000000000 x22: ffff8003e62450c0
[ 47.997379] x21: ffff8003dfd6add8 x20: 0000000000000003
[ 48.002678] x19: ffff8003e6245100 x18: 0000000000000000
[ 48.007976] x17: 0000000000000000 x16: 0000000000000000
[ 48.013274] x15: 0000000000000000 x14: 0000000000000000
[ 48.018572] x13: ffff7e000ef83a00 x12: 0000000000000001
[ 48.023870] x11: ffff000010eff998 x10: 00000000000019a0
[ 48.029169] x9 : 0000000000000000 x8 : ffff8003e6245180
[ 48.034467] x7 : 0000000000000000 x6 : 000000000000003f
[ 48.039766] x5 : 0000000000000040 x4 : ffff8003e0145080
[ 48.045064] x3 : dead000000000200 x2 : 0000000000000000
[ 48.050362] x1 : 0000000000000000 x0 : ffff8003e62450c0
[ 48.055660] Call trace:
[ 48.058095] __list_del_entry_valid+0x2c/0xa8
[ 48.062442] ccp_tx_submit+0x84/0x168 [ccp]
[ 48.066615] async_tx_submit+0x224/0x368 [async_tx]
[ 48.071480] async_trigger_callback+0x68/0xfc [async_tx]
[ 48.076784] ops_run_biofill+0x178/0x1e8 [raid456]
[ 48.081566] raid_run_ops+0x248/0x818 [raid456]
[ 48.086086] handle_stripe+0x864/0x1208 [raid456]
[ 48.090781] handle_active_stripes.isra.0+0xb0/0x278 [raid456]
[ 48.096604] raid5d+0x378/0x618 [raid456]
[ 48.100602] md_thread+0xa0/0x150
[ 48.103905] kthread+0x104/0x130
[ 48.107122] ret_from_fork+0x10/0x18
[ 48.110686] Code: d2804003 f2fbd5a3 eb03003f 54000320 (f9400021)
[ 48.116766] ---[ end trace 23f390a527f7ad77 ]---
ccp_tx_submit is passed a dma_async_tx_descriptor which is contained in
a ccp_dma_desc and adds it to a ccp channel's pending list:
list_del(&desc->entry);
list_add_tail(&desc->entry, &chan->pending);
The problem is that desc->entry may be uninitialized in the
async_trigger_callback path where the descriptor was gotten
from ccp_prep_dma_interrupt which got it from ccp_alloc_dma_desc
which doesn't initialize the desc->entry list head. So, just
initialize the list head to avoid the problem.
Cc: <stable@vger.kernel.org>
Reported-by: Sahaj Sarup <sahajsarup@gmail.com>
Signed-off-by: Mark Salter <msalter@redhat.com>
Acked-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/ccp/ccp-dmaengine.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/crypto/ccp/ccp-dmaengine.c
+++ b/drivers/crypto/ccp/ccp-dmaengine.c
@@ -337,6 +337,7 @@ static struct ccp_dma_desc *ccp_alloc_dm
desc->tx_desc.flags = flags;
desc->tx_desc.tx_submit = ccp_tx_submit;
desc->ccp = chan->ccp;
+ INIT_LIST_HEAD(&desc->entry);
INIT_LIST_HEAD(&desc->pending);
INIT_LIST_HEAD(&desc->active);
desc->status = DMA_IN_PROGRESS;
next prev parent reply other threads:[~2019-12-11 15:15 UTC|newest]
Thread overview: 125+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-11 15:04 [PATCH 5.3 000/105] 5.3.16-stable review Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.3 001/105] rsi: release skb if rsi_prepare_beacon fails Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.3 002/105] arm64: tegra: Fix active-low warning for Jetson TX1 regulator Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.3 003/105] perf scripts python: exported-sql-viewer.py: Fix use of TRUE with SQLite Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.3 004/105] sparc64: implement ioremap_uc Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.3 005/105] lp: fix sparc64 LPSETTIMEOUT ioctl Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.3 006/105] time: Zero the upper 32-bits in __kernel_timespec on 32-bit Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.3 007/105] usb: gadget: u_serial: add missing port entry locking Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.3 008/105] tty: serial: fsl_lpuart: use the sg count from dma_map_sg Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.3 009/105] tty: serial: msm_serial: Fix flow control Greg Kroah-Hartman
2019-12-11 15:04 ` [PATCH 5.3 010/105] serial: pl011: Fix DMA ->flush_buffer() Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 011/105] serial: serial_core: Perform NULL checks for break_ctl ops Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 012/105] serial: stm32: fix clearing interrupt error flags Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 013/105] serial: ifx6x60: add missed pm_runtime_disable Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 014/105] aio: Fix io_pgetevents() struct __compat_aio_sigset layout Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 015/105] autofs: fix a leak in autofs_expire_indirect() Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 016/105] MIPS: SGI-IP27: fix exception handler replication Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 017/105] RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 018/105] RDMA/hns: Correct the value of srq_desc_size Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 019/105] iwlwifi: pcie: dont consider IV len in A-MSDU Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 020/105] cgroup: dont put ERR_PTR() into fc->root Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 021/105] exportfs_decode_fh(): negative pinned may become positive without the parent locked Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 022/105] audit_get_nd(): dont unlock parent too early Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 023/105] ecryptfs: fix unlink and rmdir in face of underlying fs modifications Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 024/105] ALSA: hda: Add Cometlake-S PCI ID Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 025/105] NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 026/105] xfrm: release device reference for invalid state Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 027/105] block: check bi_size overflow before merge Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 028/105] Input: cyttsp4_core - fix use after free bug Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 029/105] sched/core: Avoid spurious lock dependencies Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 030/105] sched/pelt: Fix update of blocked PELT ordering Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 031/105] perf/core: Consistently fail fork on allocation failures Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 032/105] ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 033/105] x86/resctrl: Fix potential lockdep warning Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 034/105] drm/sun4i: tcon: Set min division of TCON0_DCLK to 1 Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 035/105] selftests: kvm: fix build with glibc >= 2.30 Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 036/105] rbd: silence bogus uninitialized warning in rbd_object_map_update_finish() Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 037/105] rsxx: add missed destroy_workqueue calls in remove Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 038/105] ravb: implement MTU change while device is up Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 039/105] net: hns3: reallocate SSU buffer size when pfc_en changes Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 040/105] net: hns3: fix ETS bandwidth validation bug Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 041/105] afs: Fix race in commit bulk status fetch Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 042/105] net: ep93xx_eth: fix mismatch of request_mem_region in remove Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 043/105] i2c: core: fix use after free in of_i2c_notify Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 044/105] io_uring: transform send/recvmsg() -ERESTARTSYS to -EINTR Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 045/105] fuse: verify nlink Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 046/105] fuse: verify attributes Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 047/105] io_uring: ensure req->submit is copied when req is deferred Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 048/105] SUNRPC: Avoid RPC delays when exiting suspend Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 049/105] ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 050/105] ALSA: hda/realtek - Enable the headset-mic on a Xiaomis laptop Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 051/105] ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 052/105] ALSA: pcm: oss: Avoid potential buffer overflows Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 053/105] ALSA: hda - Add mute led support for HP ProBook 645 G4 Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 054/105] ALSA: hda: Modify stream stripe mask only when needed Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 055/105] Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 056/105] Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 057/105] Input: synaptics-rmi4 - dont increment rmiaddr for SMBus transfers Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 058/105] Input: goodix - add upside-down quirk for Teclast X89 tablet Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 059/105] coresight: etm4x: Fix input validation for sysfs Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 060/105] Input: Fix memory leak in psxpad_spi_probe Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 061/105] media: rc: mark input device as pointing stick Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 062/105] x86/mm/32: Sync only to VMALLOC_END in vmalloc_sync_all() Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 063/105] x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 064/105] CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 065/105] CIFS: Fix SMB2 oplock break processing Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 066/105] tty: vt: keyboard: reject invalid keycodes Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 067/105] can: slcan: Fix use-after-free Read in slcan_open Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 068/105] nfsd: Ensure CLONE persists data and metadata changes to the target file Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 069/105] nfsd: restore NFSv3 ACL support Greg Kroah-Hartman
2019-12-11 15:05 ` [PATCH 5.3 070/105] kernfs: fix ino wrap-around detection Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 071/105] jbd2: Fix possible overflow in jbd2_log_space_left() Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 072/105] drm/msm: fix memleak on release Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 073/105] drm: damage_helper: Fix race checking plane->state->fb Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 074/105] drm/i810: Prevent underflow in ioctl Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 075/105] arm64: dts: exynos: Revert "Remove unneeded address space mapping for soc node" Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 076/105] KVM: PPC: Book3S HV: XIVE: Free previous EQ page when setting up a new one Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 077/105] KVM: PPC: Book3S HV: XIVE: Fix potential page leak on error path Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 078/105] KVM: PPC: Book3S HV: XIVE: Set kvm->arch.xive when VPs are allocated Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 079/105] KVM: nVMX: Always write vmcs02.GUEST_CR3 during nested VM-Enter Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 080/105] KVM: arm/arm64: vgic: Dont rely on the wrong pending table Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 081/105] KVM: x86: do not modify masked bits of shared MSRs Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 082/105] KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 083/105] KVM: x86: Remove a spurious export of a static function Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 084/105] KVM: x86: Grab KVMs srcu lock when setting nested state Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 085/105] crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 086/105] crypto: atmel-aes - Fix IV handling when req->nbytes < ivsize Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 087/105] crypto: af_alg - cast ki_complete ternary op to int Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 088/105] crypto: geode-aes - switch to skcipher for cbc(aes) fallback Greg Kroah-Hartman
2019-12-11 15:06 ` Greg Kroah-Hartman [this message]
2019-12-11 15:06 ` [PATCH 5.3 090/105] crypto: ecdh - fix big endian bug in ECC library Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 091/105] crypto: user - fix memory leak in crypto_report Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 092/105] crypto: user - fix memory leak in crypto_reportstat Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 093/105] spi: spi-fsl-qspi: Clear TDH bits in FLSHCR register Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 094/105] spi: stm32-qspi: Fix kernel oops when unbinding driver Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 095/105] spi: atmel: Fix CS high support Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 096/105] spi: Fix SPI_CS_HIGH setting when using native and GPIO CS Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 097/105] spi: Fix NULL pointer when setting SPI_CS_HIGH for " Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 098/105] can: ucan: fix non-atomic allocation in completion handler Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 099/105] RDMA/qib: Validate ->show()/store() callbacks before calling them Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 100/105] iomap: Fix pipe page leakage during splicing Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 101/105] thermal: Fix deadlock in thermal thermal_zone_device_check Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 102/105] vcs: prevent write access to vcsu devices Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 103/105] binder: Fix race between mmap() and binder_alloc_print_pages() Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 104/105] binder: Prevent repeated use of ->mmap() via NULL mapping Greg Kroah-Hartman
2019-12-11 15:06 ` [PATCH 5.3 105/105] binder: Handle start==NULL in binder_update_page_range() Greg Kroah-Hartman
2019-12-11 16:16 ` [PATCH 5.3 000/105] 5.3.16-stable review Jeffrin Jose
2019-12-11 18:28 ` Greg Kroah-Hartman
2019-12-11 19:22 ` Jeffrin Jose
2019-12-11 21:23 ` Jeffrin Jose
2019-12-11 21:13 ` Jon Hunter
2019-12-12 9:30 ` Greg Kroah-Hartman
2019-12-11 21:43 ` [PATCH 5.3 000/105] 5.3.16-stable review [warning related] Jeffrin Jose
2019-12-12 7:42 ` Greg Kroah-Hartman
2019-12-12 2:47 ` [PATCH 5.3 000/105] 5.3.16-stable review shuah
2019-12-12 5:22 ` Naresh Kamboju
2019-12-12 6:52 ` Jeffrin Jose
2019-12-12 7:41 ` Greg Kroah-Hartman
2019-12-12 8:05 ` Jeffrin Jose
2019-12-12 9:10 ` Greg Kroah-Hartman
2019-12-12 10:04 ` Greg Kroah-Hartman
2019-12-12 12:18 ` Greg Kroah-Hartman
2019-12-12 13:16 ` Jon Hunter
2019-12-13 4:53 ` Naresh Kamboju
2019-12-12 18:24 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191211150300.377604506@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=gary.hook@amd.com \
--cc=herbert@gondor.apana.org.au \
--cc=linux-kernel@vger.kernel.org \
--cc=msalter@redhat.com \
--cc=sahajsarup@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox