2022-01-22 02:04:53

by Shijith Thotton

[permalink] [raw]
Subject: [PATCH v2] crypto: octeontx2: fix NULL pointer dereference

CONFIG_DM_CRYPT is checked before registering ciphers, but not before
unregister. This could lead to a NULL pointer dereference during driver
release (in unregister) if CONFIG_DM_CRYPT is enabled.

...
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
...
Call trace:
crypto_unregister_alg+0x68/0xfc
crypto_unregister_skciphers+0x44/0x60
otx2_cpt_crypto_exit+0x100/0x1a0
otx2_cptvf_remove+0xf8/0x200
pci_device_remove+0x3c/0xd4
__device_release_driver+0x188/0x234
device_release_driver+0x2c/0x4c
...

Added a CONFIG_DM_CRYPT check, similar to register, in unregister to
avoid this.

Fixes: 6f03f0e8b6c8 ("crypto: octeontx2 - register with linux crypto framework")

Signed-off-by: Shijith Thotton <[email protected]>
---
v2:
- Added fixes line to commit message.

drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
index 2748a3327e39..620fa9b23e78 100644
--- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
+++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
@@ -1650,7 +1650,7 @@ static inline int cpt_register_algs(void)

err = crypto_register_aeads(otx2_cpt_aeads,
ARRAY_SIZE(otx2_cpt_aeads));
- if (err) {
+ if (err && !IS_ENABLED(CONFIG_DM_CRYPT)) {
crypto_unregister_skciphers(otx2_cpt_skciphers,
ARRAY_SIZE(otx2_cpt_skciphers));
return err;
@@ -1661,8 +1661,9 @@ static inline int cpt_register_algs(void)

static inline void cpt_unregister_algs(void)
{
- crypto_unregister_skciphers(otx2_cpt_skciphers,
- ARRAY_SIZE(otx2_cpt_skciphers));
+ if (!IS_ENABLED(CONFIG_DM_CRYPT))
+ crypto_unregister_skciphers(otx2_cpt_skciphers,
+ ARRAY_SIZE(otx2_cpt_skciphers));
crypto_unregister_aeads(otx2_cpt_aeads, ARRAY_SIZE(otx2_cpt_aeads));
}

--
2.25.1


2022-01-29 17:55:39

by Herbert Xu

[permalink] [raw]
Subject: Re: [PATCH v2] crypto: octeontx2: fix NULL pointer dereference

Shijith Thotton <[email protected]> wrote:
>
> diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
> index 2748a3327e39..620fa9b23e78 100644
> --- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
> +++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
> @@ -1650,7 +1650,7 @@ static inline int cpt_register_algs(void)
>
> err = crypto_register_aeads(otx2_cpt_aeads,
> ARRAY_SIZE(otx2_cpt_aeads));
> - if (err) {
> + if (err && !IS_ENABLED(CONFIG_DM_CRYPT)) {
> crypto_unregister_skciphers(otx2_cpt_skciphers,
> ARRAY_SIZE(otx2_cpt_skciphers));
> return err;

A better fix would be to make the driver actually work with
dm-crypt. What exactly is the issue?

Even if we have to keep the kludge, please move this into Kconfig
as a dependency and simply disable the whole driver.

Thanks,
--
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

2022-01-31 11:05:05

by Shijith Thotton

[permalink] [raw]
Subject: [PATCH v3] crypto: octeontx2: remove CONFIG_DM_CRYPT check

No issues were found while using the driver with dm-crypt enabled. So
CONFIG_DM_CRYPT check in the driver can be removed.

This also fixes the NULL pointer dereference in driver release if
CONFIG_DM_CRYPT is enabled.

...
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
...
Call trace:
crypto_unregister_alg+0x68/0xfc
crypto_unregister_skciphers+0x44/0x60
otx2_cpt_crypto_exit+0x100/0x1a0
otx2_cptvf_remove+0xf8/0x200
pci_device_remove+0x3c/0xd4
__device_release_driver+0x188/0x234
device_release_driver+0x2c/0x4c
...

Fixes: 6f03f0e8b6c8 ("crypto: octeontx2 - register with linux crypto framework")
Signed-off-by: Shijith Thotton <[email protected]>
---
.../crypto/marvell/octeontx2/otx2_cptvf_algs.c | 17 +++++++----------
1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
index 2748a3327e39..f8f8542ce3e4 100644
--- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
+++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
@@ -1634,16 +1634,13 @@ static inline int cpt_register_algs(void)
{
int i, err = 0;

- if (!IS_ENABLED(CONFIG_DM_CRYPT)) {
- for (i = 0; i < ARRAY_SIZE(otx2_cpt_skciphers); i++)
- otx2_cpt_skciphers[i].base.cra_flags &=
- ~CRYPTO_ALG_DEAD;
-
- err = crypto_register_skciphers(otx2_cpt_skciphers,
- ARRAY_SIZE(otx2_cpt_skciphers));
- if (err)
- return err;
- }
+ for (i = 0; i < ARRAY_SIZE(otx2_cpt_skciphers); i++)
+ otx2_cpt_skciphers[i].base.cra_flags &= ~CRYPTO_ALG_DEAD;
+
+ err = crypto_register_skciphers(otx2_cpt_skciphers,
+ ARRAY_SIZE(otx2_cpt_skciphers));
+ if (err)
+ return err;

for (i = 0; i < ARRAY_SIZE(otx2_cpt_aeads); i++)
otx2_cpt_aeads[i].base.cra_flags &= ~CRYPTO_ALG_DEAD;
--
2.25.1

2022-02-07 10:17:43

by Herbert Xu

[permalink] [raw]
Subject: Re: [PATCH v3] crypto: octeontx2: remove CONFIG_DM_CRYPT check

On Fri, Jan 28, 2022 at 07:27:42PM +0530, Shijith Thotton wrote:
> No issues were found while using the driver with dm-crypt enabled. So
> CONFIG_DM_CRYPT check in the driver can be removed.
>
> This also fixes the NULL pointer dereference in driver release if
> CONFIG_DM_CRYPT is enabled.
>
> ...
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
> ...
> Call trace:
> crypto_unregister_alg+0x68/0xfc
> crypto_unregister_skciphers+0x44/0x60
> otx2_cpt_crypto_exit+0x100/0x1a0
> otx2_cptvf_remove+0xf8/0x200
> pci_device_remove+0x3c/0xd4
> __device_release_driver+0x188/0x234
> device_release_driver+0x2c/0x4c
> ...
>
> Fixes: 6f03f0e8b6c8 ("crypto: octeontx2 - register with linux crypto framework")
> Signed-off-by: Shijith Thotton <[email protected]>
> ---
> .../crypto/marvell/octeontx2/otx2_cptvf_algs.c | 17 +++++++----------
> 1 file changed, 7 insertions(+), 10 deletions(-)

Patch applied. Thanks.
--
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt