2021-12-20 19:50:43

by Marek Vasut

[permalink] [raw]
Subject: [PATCH] crypto: stm32/crc32 - Fix kernel BUG triggered in probe()

The include/linux/crypto.h struct crypto_alg field cra_driver_name description
states "Unique name of the transformation provider. " ... " this contains the
name of the chip or provider and the name of the transformation algorithm."

In case of the stm32-crc driver, field cra_driver_name is identical for all
registered transformation providers and set to the name of the driver itself,
which is incorrect. This patch fixes it by assigning a unique cra_driver_name
to each registered transformation provider.

The kernel crash is triggered when the driver calls crypto_register_shashes()
which calls crypto_register_shash(), which calls crypto_register_alg(), which
calls __crypto_register_alg(), which returns -EEXIST, which is propagated
back through this call chain. Upon -EEXIST from crypto_register_shash(), the
crypto_register_shashes() starts unregistering the providers back, and calls
crypto_unregister_shash(), which calls crypto_unregister_alg(), and this is
where the BUG() triggers due to incorrect cra_refcnt.

Fixes: b51dbe90912a ("crypto: stm32 - Support for STM32 CRC32 crypto module")
Signed-off-by: Marek Vasut <[email protected]>
Cc: <[email protected]> # 4.12+
Cc: Alexandre Torgue <[email protected]>
Cc: Fabien Dessenne <[email protected]>
Cc: Herbert Xu <[email protected]>
Cc: Lionel Debieve <[email protected]>
Cc: Nicolas Toromanoff <[email protected]>
Cc: [email protected]
Cc: [email protected]
To: [email protected]
---
drivers/crypto/stm32/stm32-crc32.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/stm32/stm32-crc32.c b/drivers/crypto/stm32/stm32-crc32.c
index 75867c0b0017..be1bf39a317d 100644
--- a/drivers/crypto/stm32/stm32-crc32.c
+++ b/drivers/crypto/stm32/stm32-crc32.c
@@ -279,7 +279,7 @@ static struct shash_alg algs[] = {
.digestsize = CHKSUM_DIGEST_SIZE,
.base = {
.cra_name = "crc32",
- .cra_driver_name = DRIVER_NAME,
+ .cra_driver_name = "stm32-crc32-crc32",
.cra_priority = 200,
.cra_flags = CRYPTO_ALG_OPTIONAL_KEY,
.cra_blocksize = CHKSUM_BLOCK_SIZE,
@@ -301,7 +301,7 @@ static struct shash_alg algs[] = {
.digestsize = CHKSUM_DIGEST_SIZE,
.base = {
.cra_name = "crc32c",
- .cra_driver_name = DRIVER_NAME,
+ .cra_driver_name = "stm32-crc32-crc32c",
.cra_priority = 200,
.cra_flags = CRYPTO_ALG_OPTIONAL_KEY,
.cra_blocksize = CHKSUM_BLOCK_SIZE,
--
2.34.1



2021-12-21 08:13:44

by Nicolas Toromanoff

[permalink] [raw]
Subject: Re: [Linux-stm32] [PATCH] crypto: stm32/crc32 - Fix kernel BUG triggered in probe()

On Mon, 20 Dec 2021, Marek Vasut wrote:

> The include/linux/crypto.h struct crypto_alg field cra_driver_name description
> states "Unique name of the transformation provider. " ... " this contains the
> name of the chip or provider and the name of the transformation algorithm."
>
> In case of the stm32-crc driver, field cra_driver_name is identical for all
> registered transformation providers and set to the name of the driver itself,
> which is incorrect. This patch fixes it by assigning a unique cra_driver_name
> to each registered transformation provider.
>
> The kernel crash is triggered when the driver calls crypto_register_shashes()
> which calls crypto_register_shash(), which calls crypto_register_alg(), which
> calls __crypto_register_alg(), which returns -EEXIST, which is propagated
> back through this call chain. Upon -EEXIST from crypto_register_shash(), the
> crypto_register_shashes() starts unregistering the providers back, and calls
> crypto_unregister_shash(), which calls crypto_unregister_alg(), and this is
> where the BUG() triggers due to incorrect cra_refcnt.
>
> Fixes: b51dbe90912a ("crypto: stm32 - Support for STM32 CRC32 crypto module")
> Signed-off-by: Marek Vasut <[email protected]>
> Cc: <[email protected]> # 4.12+
> Cc: Alexandre Torgue <[email protected]>
> Cc: Fabien Dessenne <[email protected]>
> Cc: Herbert Xu <[email protected]>
> Cc: Lionel Debieve <[email protected]>
> Cc: Nicolas Toromanoff <nicola[email protected]>
> Cc: [email protected]
> Cc: [email protected]
> To: [email protected]
> ---
> drivers/crypto/stm32/stm32-crc32.c | 4 ++--

Hello Marek,

Thanks for the fix.

Acked-by: Nicolas Toromanoff <[email protected]>


2021-12-31 11:34:52

by Herbert Xu

[permalink] [raw]
Subject: Re: [PATCH] crypto: stm32/crc32 - Fix kernel BUG triggered in probe()

On Mon, Dec 20, 2021 at 08:50:22PM +0100, Marek Vasut wrote:
> The include/linux/crypto.h struct crypto_alg field cra_driver_name description
> states "Unique name of the transformation provider. " ... " this contains the
> name of the chip or provider and the name of the transformation algorithm."
>
> In case of the stm32-crc driver, field cra_driver_name is identical for all
> registered transformation providers and set to the name of the driver itself,
> which is incorrect. This patch fixes it by assigning a unique cra_driver_name
> to each registered transformation provider.
>
> The kernel crash is triggered when the driver calls crypto_register_shashes()
> which calls crypto_register_shash(), which calls crypto_register_alg(), which
> calls __crypto_register_alg(), which returns -EEXIST, which is propagated
> back through this call chain. Upon -EEXIST from crypto_register_shash(), the
> crypto_register_shashes() starts unregistering the providers back, and calls
> crypto_unregister_shash(), which calls crypto_unregister_alg(), and this is
> where the BUG() triggers due to incorrect cra_refcnt.
>
> Fixes: b51dbe90912a ("crypto: stm32 - Support for STM32 CRC32 crypto module")
> Signed-off-by: Marek Vasut <[email protected]>
> Cc: <[email protected]> # 4.12+
> Cc: Alexandre Torgue <[email protected]>
> Cc: Fabien Dessenne <[email protected]>
> Cc: Herbert Xu <[email protected]>
> Cc: Lionel Debieve <[email protected]>
> Cc: Nicolas Toromanoff <[email protected]>
> Cc: [email protected]
> Cc: [email protected]
> To: [email protected]
> ---
> drivers/crypto/stm32/stm32-crc32.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)

Patch applied. Thanks.
--
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt