Received: by 10.213.65.68 with SMTP id h4csp414378imn; Wed, 28 Mar 2018 06:08:37 -0700 (PDT) X-Google-Smtp-Source: AIpwx49+/jR1ZBlC7syTo4xWeHGiwyoBVLQufNSbObVggcAkCoaGpMSlTn5ejBBylDsT6XnmL0PS X-Received: by 2002:a17:902:2884:: with SMTP id f4-v6mr3737050plb.153.1522242517153; Wed, 28 Mar 2018 06:08:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1522242517; cv=none; d=google.com; s=arc-20160816; b=si4TyKkNdhOu+qH1iGCv4l9X2f2jkqbq7PMshPMfJyh1BfOL7tr6KcmR9k8qeU3cfh 5SyF9eznaiYWhBbGqGeq6gI9SV9/TEI/3rnox4ilUXIzRqcRSVCiZl4ya+oiQzP6RoAG 16HSGurwOCbHfowcQU62rycCzXXvpLWd3mw8PyuvTO1o2JjWYjxT4ficNizh7yG+5cIb 07gwlGXM2r0rbY6gD3Lpm1+zvB/YsGSJB1LtkmDDUpTreMqGMx7N8FvVKWO9nj3+85NM kpHmFx9NBZ2RNQ62E47cUeFVlw+l3LetyMFOrZgi0/gM/1eHmEw3nCmCTI2FZyEuZbaE dF1Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :arc-authentication-results; bh=zZi1P5wlQWwSdHcPhsiUlxsFrh+WechaWkc7BzUwW3s=; b=YURou3IoYJG46ETn5HMCbyG1Gb2bCuBeOpn5MkxOT90gqqy4czeEpOwSq9Ap0Opqj4 rj+L7RJmlwIuVqw7s+Yj2ZxqDOr52jW6LJk5IaWllATXRilPj3SKsMyewydL6ZjZLIb9 5jWVv1f1jHlNdNO0v5QPgkGH9xGAg7EaoC3ap013KAs8MobtF6Kz5pVzJ27sWiMustT6 UgBWsxZwy1krXCpZNBS+VLRoESEuMWJVAVoJtPK3h+4y/kRmEIU5IKADW61MiFkibFUV s2sw8hDpV6oakSXIstywbmnqYHSOiMAUE0L7niYqkG4IlNPPbRlS7QB61xz3x5dwVMqg wtjQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id o10si2510678pgq.432.2018.03.28.06.07.55; Wed, 28 Mar 2018 06:08:37 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753331AbeC1NGi (ORCPT + 99 others); Wed, 28 Mar 2018 09:06:38 -0400 Received: from mail-wm0-f66.google.com ([74.125.82.66]:38554 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752978AbeC1NGe (ORCPT ); Wed, 28 Mar 2018 09:06:34 -0400 Received: by mail-wm0-f66.google.com with SMTP id l16so5181271wmh.3; Wed, 28 Mar 2018 06:06:33 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=zZi1P5wlQWwSdHcPhsiUlxsFrh+WechaWkc7BzUwW3s=; b=Dxgeipm1VGGs1IGS+lZ/pfzW6Vt2Q/Gzmh9hscox9dvlYM6w79iXH8UDd69PrTduM2 Ghb9IiCB67JufO3qgfYr86FVj87TOQ9Doc4dEeqVUplTYSvsA11U4RKOlDlJDuOCfbV9 gEJnSmGk5m6MMD6oGKarExWt0sXgFWuqeBYpWMTcAqPN0sq7QaIAWYUB1IhTycqaueMK O3y5sQiU5laIqtw9sCOw31f6DBfSKPLiL/Kx8Abi2EHh9Doa5JZJYpU+ul+5BMiYKFHC y7S1ELMnHVrVF4EgmVIvXN/zqkWe/rtUYdxmc79WkL1bPzLidvMQDlIk9ArfGBJDPsSW Z0Ew== X-Gm-Message-State: AElRT7GL2Vln0V4DTbHtM7AQRphLWjYTQ91W9tFju975YzIMVVe/9MWU kDKQ9sKcJpJDHuUlXLNKX04= X-Received: by 10.28.25.199 with SMTP id 190mr2556069wmz.19.1522242392646; Wed, 28 Mar 2018 06:06:32 -0700 (PDT) Received: from hc.cavium.com (ip-109-42-2-53.web.vodafone.de. [109.42.2.53]) by smtp.gmail.com with ESMTPSA id i52sm7196162wra.82.2018.03.28.06.06.31 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 28 Mar 2018 06:06:31 -0700 (PDT) From: Jan Glauber To: Herbert Xu Cc: "David S . Miller" , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Mahipal Challa , Robert Richter , Jan Glauber , stable Subject: [PATCH 1/2] crypto: thunderx_zip: Fix fallout from CONFIG_VMAP_STACK Date: Wed, 28 Mar 2018 15:05:56 +0200 Message-Id: <20180328130557.10560-1-jglauber@cavium.com> X-Mailer: git-send-email 2.16.2 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Enabling virtual mapped kernel stacks breaks the thunderx_zip driver. On compression or decompression the executing CPU hangs in an endless loop. The reason for this is the usage of __pa by the driver which does no longer work for an address that is not part of the 1:1 mapping. The zip driver allocates a result struct on the stack and needs to tell the hardware the physical address within this struct that is used to signal the completion of the request. As the hardware gets the wrong address after the broken __pa conversion it writes to an arbitrary address. The zip driver then waits forever for the completion byte to contain a non-zero value. Allocating the result struct from 1:1 mapped memory resolves this bug. Signed-off-by: Jan Glauber Reviewed-by: Robert Richter Cc: stable # 4.14 --- drivers/crypto/cavium/zip/zip_crypto.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/drivers/crypto/cavium/zip/zip_crypto.c b/drivers/crypto/cavium/zip/zip_crypto.c index 8df4d26..2fc9b03 100644 --- a/drivers/crypto/cavium/zip/zip_crypto.c +++ b/drivers/crypto/cavium/zip/zip_crypto.c @@ -124,7 +124,7 @@ int zip_compress(const u8 *src, unsigned int slen, struct zip_kernel_ctx *zip_ctx) { struct zip_operation *zip_ops = NULL; - struct zip_state zip_state; + struct zip_state *zip_state; struct zip_device *zip = NULL; int ret; @@ -135,20 +135,23 @@ int zip_compress(const u8 *src, unsigned int slen, if (!zip) return -ENODEV; - memset(&zip_state, 0, sizeof(struct zip_state)); + zip_state = kzalloc(sizeof(*zip_state), GFP_KERNEL); + if (!zip_state) + return -ENOMEM; + zip_ops = &zip_ctx->zip_comp; zip_ops->input_len = slen; zip_ops->output_len = *dlen; memcpy(zip_ops->input, src, slen); - ret = zip_deflate(zip_ops, &zip_state, zip); + ret = zip_deflate(zip_ops, zip_state, zip); if (!ret) { *dlen = zip_ops->output_len; memcpy(dst, zip_ops->output, *dlen); } - + kfree(zip_state); return ret; } @@ -157,7 +160,7 @@ int zip_decompress(const u8 *src, unsigned int slen, struct zip_kernel_ctx *zip_ctx) { struct zip_operation *zip_ops = NULL; - struct zip_state zip_state; + struct zip_state *zip_state; struct zip_device *zip = NULL; int ret; @@ -168,7 +171,10 @@ int zip_decompress(const u8 *src, unsigned int slen, if (!zip) return -ENODEV; - memset(&zip_state, 0, sizeof(struct zip_state)); + zip_state = kzalloc(sizeof(*zip_state), GFP_KERNEL); + if (!zip_state) + return -ENOMEM; + zip_ops = &zip_ctx->zip_decomp; memcpy(zip_ops->input, src, slen); @@ -179,13 +185,13 @@ int zip_decompress(const u8 *src, unsigned int slen, zip_ops->input_len = slen; zip_ops->output_len = *dlen; - ret = zip_inflate(zip_ops, &zip_state, zip); + ret = zip_inflate(zip_ops, zip_state, zip); if (!ret) { *dlen = zip_ops->output_len; memcpy(dst, zip_ops->output, *dlen); } - + kfree(zip_state); return ret; } -- 2.7.4