stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Andrey Ryabinin <aryabinin@virtuozzo.com>,
	Herbert Xu <herbert@gondor.apana.org.au>
Subject: [PATCH 3.18 18/28] crypto: x86/sha1-mb - fix panic due to unaligned access
Date: Mon, 13 Nov 2017 13:55:12 +0100	[thread overview]
Message-ID: <20171113125402.470624119@linuxfoundation.org> (raw)
In-Reply-To: <20171113125400.803506921@linuxfoundation.org>

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrey Ryabinin <aryabinin@virtuozzo.com>

commit d041b557792c85677f17e08eee535eafbd6b9aa2 upstream.

struct sha1_ctx_mgr allocated in sha1_mb_mod_init() via kzalloc()
and later passed in sha1_mb_flusher_mgr_flush_avx2() function where
instructions vmovdqa used to access the struct. vmovdqa requires
16-bytes aligned argument, but nothing guarantees that struct
sha1_ctx_mgr will have that alignment. Unaligned vmovdqa will
generate GP fault.

Fix this by replacing vmovdqa with vmovdqu which doesn't have alignment
requirements.

Fixes: 2249cbb53ead ("crypto: sha-mb - SHA1 multibuffer submit and flush routines for AVX2")
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S
+++ b/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S
@@ -174,8 +174,8 @@ LABEL skip_ %I
 .endr
 
 	# Find min length
-	vmovdqa _lens+0*16(state), %xmm0
-	vmovdqa _lens+1*16(state), %xmm1
+	vmovdqu _lens+0*16(state), %xmm0
+	vmovdqu _lens+1*16(state), %xmm1
 
 	vpminud %xmm1, %xmm0, %xmm2     # xmm2 has {D,C,B,A}
 	vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}
@@ -195,8 +195,8 @@ LABEL skip_ %I
 	vpsubd  %xmm2, %xmm0, %xmm0
 	vpsubd  %xmm2, %xmm1, %xmm1
 
-	vmovdqa %xmm0, _lens+0*16(state)
-	vmovdqa %xmm1, _lens+1*16(state)
+	vmovdqu %xmm0, _lens+0*16(state)
+	vmovdqu %xmm1, _lens+1*16(state)
 
 	# "state" and "args" are the same address, arg1
 	# len is arg2
@@ -260,8 +260,8 @@ ENTRY(sha1_mb_mgr_get_comp_job_avx2)
 	jc      .return_null
 
 	# Find min length
-	vmovdqa _lens(state), %xmm0
-	vmovdqa _lens+1*16(state), %xmm1
+	vmovdqu _lens(state), %xmm0
+	vmovdqu _lens+1*16(state), %xmm1
 
 	vpminud %xmm1, %xmm0, %xmm2        # xmm2 has {D,C,B,A}
 	vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}

  parent reply	other threads:[~2017-11-13 12:55 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-11-13 12:54 [PATCH 3.18 00/28] 3.18.81-stable review Greg Kroah-Hartman
2017-11-13 12:54 ` [PATCH 3.18 01/28] video: fbdev: pmag-ba-fb: Remove bad `__init annotation Greg Kroah-Hartman
2017-11-13 12:54 ` [PATCH 3.18 02/28] xen/netback: set default upper limit of tx/rx queues to 8 Greg Kroah-Hartman
2017-11-13 12:54 ` [PATCH 3.18 03/28] ARM: dts: imx53-qsb-common: fix FEC pinmux config Greg Kroah-Hartman
2017-11-16  4:08   ` Patrick Brünn
2017-11-13 12:54 ` [PATCH 3.18 05/28] ARM: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6 Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 06/28] iio: trigger: free trigger resource correctly Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 07/28] dt-bindings: Add LEGO MINDSTORMS EV3 compatible specification Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 08/28] dt-bindings: Add vendor prefix for LEGO Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 10/28] serial: sh-sci: Fix register offsets for the IRDA serial port Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 11/28] usb: hcd: initialize hcd->flags to 0 when rm hcd Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 12/28] IPsec: do not ignore crypto err in ah4 input Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 13/28] Input: mpr121 - handle multiple bits change of status register Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 14/28] Input: mpr121 - set missing event capability Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 15/28] IB/ipoib: Change list_del to list_del_init in the tx object Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 16/28] KEYS: trusted: sanitize all key material Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 17/28] KEYS: trusted: fix writing past end of buffer in trusted_read() Greg Kroah-Hartman
2017-11-13 12:55 ` Greg Kroah-Hartman [this message]
2017-11-13 12:55 ` [PATCH 3.18 19/28] KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2] Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 20/28] ARM: 8720/1: ensure dump_instr() checks addr_limit Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 21/28] ALSA: seq: Fix OSS sysex delivery in OSS emulation Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 22/28] ALSA: seq: Avoid invalid lockdep class warning Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 23/28] MIPS: microMIPS: Fix incorrect mask in insn_table_MM Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 24/28] MIPS: Fix CM region target definitions Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 25/28] MIPS: AR7: Ensure that serial ports are properly set up Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 26/28] rbd: use GFP_NOIO for parent stat and data requests Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 28/28] x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context Greg Kroah-Hartman
2017-11-13 21:50 ` [PATCH 3.18 00/28] 3.18.81-stable review Shuah Khan
2017-11-14  7:43   ` Greg Kroah-Hartman
2017-11-13 22:27 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171113125402.470624119@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=aryabinin@virtuozzo.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).