Received: by 2002:a25:8b91:0:0:0:0:0 with SMTP id j17csp772435ybl; Wed, 11 Dec 2019 07:17:54 -0800 (PST) X-Google-Smtp-Source: APXvYqz2AmT0gacK66BgpO1cPaiZHg64ZjIya5eJcITDgwzSnQlnZfkr+GhvvjAJH3MDk65RaHIr X-Received: by 2002:a9d:7c8f:: with SMTP id q15mr2747501otn.341.1576077474082; Wed, 11 Dec 2019 07:17:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1576077474; cv=none; d=google.com; s=arc-20160816; b=p6qfuNj/ZwZ3opRW8yN9TllLaf4qMgsbWXZ7TcX6wdjzDVRF6lm16hNyEnv8cgU2WG MHxjDdN8A0dw1eclpIwmiIYHN0K8Z9gzPQ8J2VPLw2M8eQtB85/rNU+7GyB+Ltc9OD88 JOiX1XH05NDX5At+PL6x+XwUG2OGu0XbQqdYEz6dtWXlcI7J9I2KKtr1I1CBeEBucW5i c0VfLE4yG7BznAPdrfBRhN5LGq5adOEXbIi+/FFmHvBFOq3Q4jBCBuBbQ/Rpw+cBa+gU I9OAR/crkaijs/HQAtBptdL2M2W47RP1OtTnCh447bynFLzeZ3mnYoNwKIJPXsyrHCRP e1+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=1eNYdp0bHxnbChS/dDVmlBoc5vA7lU7PvniHn9/QKJU=; b=Rpu8We1RiCakm2I+hfEfE393eOQXKygKWXp81w3r6xjfBw9C3DkDNjiq8EtJxOEwHr 24O9n48D4DaC1248tZmTP/h8jj4n0GhVwoKMMH4csz6Wb+XoExGCLYUptOkAc5ir52fN x1FJICUKoBVbJjm/Jt0H2fS9N/F1YZLWDSXQICILqhgwZJ22vfjuQO+Hq2iJW7iTaiDL itbAJ0CalWW7Os4O9x/5W4O776+L6XAZVni4D5RkBh8u2WiY3CTUkmZggKQ0i3WLATcD ZbQHasvewU4Zdy05S6kcGTEVMxmSHgPp78UYy+NvTLtxR10C0Qbs2g/tmGAZ9+5in2nH gaXA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=VElkuX+X; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id w5si1364467oib.134.2019.12.11.07.17.40; Wed, 11 Dec 2019 07:17:54 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=VElkuX+X; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731836AbfLKPPt (ORCPT + 99 others); Wed, 11 Dec 2019 10:15:49 -0500 Received: from mail.kernel.org ([198.145.29.99]:42196 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731413AbfLKPPm (ORCPT ); Wed, 11 Dec 2019 10:15:42 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 877F9208C3; Wed, 11 Dec 2019 15:15:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1576077341; bh=KOZ9Etup0eKMsSBgtIvUGGaM6PFOy51PmIQgKWiCYXU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VElkuX+X1jhoAqhVUEeyVdiXI45FFHHVlLThEBuEd1f9JXIBzrQu9NsvxxwGhY9dy 9maFNWOlc/MJbrIOnZAe8Cxp5EUMsUELfdNPPdmv5y8Hn+2u3t5iuEGuerl2wTKE8+ JQ4TwUOSPxQvQH8SouLc9vwIhpee15B5PdQaFz6o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sahaj Sarup , Mark Salter , Gary R Hook , Herbert Xu Subject: [PATCH 5.3 089/105] crypto: ccp - fix uninitialized list head Date: Wed, 11 Dec 2019 16:06:18 +0100 Message-Id: <20191211150300.377604506@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20191211150221.153659747@linuxfoundation.org> References: <20191211150221.153659747@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mark Salter commit 691505a803a7f223b2af621848d581259c61f77d upstream. A NULL-pointer dereference was reported in fedora bz#1762199 while reshaping a raid6 array after adding a fifth drive to an existing array. [ 47.343549] md/raid:md0: raid level 6 active with 3 out of 5 devices, algorithm 2 [ 47.804017] md0: detected capacity change from 0 to 7885289422848 [ 47.822083] Unable to handle kernel read from unreadable memory at virtual address 0000000000000000 ... [ 47.940477] CPU: 1 PID: 14210 Comm: md0_raid6 Tainted: G W 5.2.18-200.fc30.aarch64 #1 [ 47.949594] Hardware name: AMD Overdrive/Supercharger/To be filled by O.E.M., BIOS ROD1002C 04/08/2016 [ 47.958886] pstate: 00400085 (nzcv daIf +PAN -UAO) [ 47.963668] pc : __list_del_entry_valid+0x2c/0xa8 [ 47.968366] lr : ccp_tx_submit+0x84/0x168 [ccp] [ 47.972882] sp : ffff00001369b970 [ 47.976184] x29: ffff00001369b970 x28: ffff00001369bdb8 [ 47.981483] x27: 00000000ffffffff x26: ffff8003b758af70 [ 47.986782] x25: ffff8003b758b2d8 x24: ffff8003e6245818 [ 47.992080] x23: 0000000000000000 x22: ffff8003e62450c0 [ 47.997379] x21: ffff8003dfd6add8 x20: 0000000000000003 [ 48.002678] x19: ffff8003e6245100 x18: 0000000000000000 [ 48.007976] x17: 0000000000000000 x16: 0000000000000000 [ 48.013274] x15: 0000000000000000 x14: 0000000000000000 [ 48.018572] x13: ffff7e000ef83a00 x12: 0000000000000001 [ 48.023870] x11: ffff000010eff998 x10: 00000000000019a0 [ 48.029169] x9 : 0000000000000000 x8 : ffff8003e6245180 [ 48.034467] x7 : 0000000000000000 x6 : 000000000000003f [ 48.039766] x5 : 0000000000000040 x4 : ffff8003e0145080 [ 48.045064] x3 : dead000000000200 x2 : 0000000000000000 [ 48.050362] x1 : 0000000000000000 x0 : ffff8003e62450c0 [ 48.055660] Call trace: [ 48.058095] __list_del_entry_valid+0x2c/0xa8 [ 48.062442] ccp_tx_submit+0x84/0x168 [ccp] [ 48.066615] async_tx_submit+0x224/0x368 [async_tx] [ 48.071480] async_trigger_callback+0x68/0xfc [async_tx] [ 48.076784] ops_run_biofill+0x178/0x1e8 [raid456] [ 48.081566] raid_run_ops+0x248/0x818 [raid456] [ 48.086086] handle_stripe+0x864/0x1208 [raid456] [ 48.090781] handle_active_stripes.isra.0+0xb0/0x278 [raid456] [ 48.096604] raid5d+0x378/0x618 [raid456] [ 48.100602] md_thread+0xa0/0x150 [ 48.103905] kthread+0x104/0x130 [ 48.107122] ret_from_fork+0x10/0x18 [ 48.110686] Code: d2804003 f2fbd5a3 eb03003f 54000320 (f9400021) [ 48.116766] ---[ end trace 23f390a527f7ad77 ]--- ccp_tx_submit is passed a dma_async_tx_descriptor which is contained in a ccp_dma_desc and adds it to a ccp channel's pending list: list_del(&desc->entry); list_add_tail(&desc->entry, &chan->pending); The problem is that desc->entry may be uninitialized in the async_trigger_callback path where the descriptor was gotten from ccp_prep_dma_interrupt which got it from ccp_alloc_dma_desc which doesn't initialize the desc->entry list head. So, just initialize the list head to avoid the problem. Cc: Reported-by: Sahaj Sarup Signed-off-by: Mark Salter Acked-by: Gary R Hook Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/ccp/ccp-dmaengine.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/crypto/ccp/ccp-dmaengine.c +++ b/drivers/crypto/ccp/ccp-dmaengine.c @@ -337,6 +337,7 @@ static struct ccp_dma_desc *ccp_alloc_dm desc->tx_desc.flags = flags; desc->tx_desc.tx_submit = ccp_tx_submit; desc->ccp = chan->ccp; + INIT_LIST_HEAD(&desc->entry); INIT_LIST_HEAD(&desc->pending); INIT_LIST_HEAD(&desc->active); desc->status = DMA_IN_PROGRESS;