From: alexander.levin@verizon.com
To: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"stable@vger.kernel.org" <stable@vger.kernel.org>
Cc: LEROY Christophe <christophe.leroy@c-s.fr>,
Herbert Xu <herbert@gondor.apana.org.au>,
alexander.levin@verizon.com
Subject: [PATCH AUTOSEL for 4.14 07/60] crypto: talitos - fix memory corruption on SEC2
Date: Wed, 13 Dec 2017 01:55:11 +0000 [thread overview]
Message-ID: <20171213015455.6455-7-alexander.levin@verizon.com> (raw)
In-Reply-To: <20171213015455.6455-1-alexander.levin@verizon.com>
From: LEROY Christophe <christophe.leroy@c-s.fr>
[ Upstream commit e04a61bebc5da1535b6f194b464295b8d558e2fc ]
On SEC2, when using the old descriptors type (hmac snoop no afeu)
for doing IPsec, the CICV out pointeur points out of the allocated
memory.
[ 2.502554] =============================================================================
[ 2.510740] BUG dma-kmalloc-256 (Not tainted): Redzone overwritten
[ 2.516907] -----------------------------------------------------------------------------
[ 2.516907]
[ 2.526535] Disabling lock debugging due to kernel taint
[ 2.531845] INFO: 0xde858108-0xde85810b. First byte 0xf8 instead of 0xcc
[ 2.538549] INFO: Allocated in 0x806181a9 age=0 cpu=0 pid=58
[ 2.544229] __kmalloc+0x374/0x564
[ 2.547649] talitos_edesc_alloc+0x17c/0x48c
[ 2.551929] aead_edesc_alloc+0x80/0x154
[ 2.555863] aead_encrypt+0x30/0xe0
[ 2.559368] __test_aead+0x5a0/0x1f3c
[ 2.563042] test_aead+0x2c/0x110
[ 2.566371] alg_test_aead+0x5c/0xf4
[ 2.569958] alg_test+0x1dc/0x5a0
[ 2.573305] cryptomgr_test+0x50/0x70
[ 2.576984] kthread+0xd8/0x134
[ 2.580155] ret_from_kernel_thread+0x5c/0x64
[ 2.584534] INFO: Freed in ipsec_esp_encrypt_done+0x130/0x240 age=6 cpu=0 pid=0
[ 2.591839] ipsec_esp_encrypt_done+0x130/0x240
[ 2.596395] flush_channel+0x1dc/0x488
[ 2.600161] talitos2_done_4ch+0x30/0x200
[ 2.604185] tasklet_action+0xa0/0x13c
[ 2.607948] __do_softirq+0x148/0x6cc
[ 2.611623] irq_exit+0xc0/0x124
[ 2.614869] call_do_irq+0x24/0x3c
[ 2.618292] do_IRQ+0x78/0x108
[ 2.621369] ret_from_except+0x0/0x14
[ 2.625055] finish_task_switch+0x58/0x350
[ 2.629165] schedule+0x80/0x134
[ 2.632409] schedule_preempt_disabled+0x38/0xc8
[ 2.637042] cpu_startup_entry+0xe4/0x190
[ 2.641074] start_kernel+0x3f4/0x408
[ 2.644741] 0x3438
[ 2.646857] INFO: Slab 0xdffbdb00 objects=9 used=1 fp=0xde8581c0 flags=0x0080
[ 2.653978] INFO: Object 0xde858008 @offset=8 fp=0xca4395df
[ 2.653978]
[ 2.661032] Redzone de858000: cc cc cc cc cc cc cc cc ........
[ 2.669029] Object de858008: 00 00 00 02 00 00 00 02 00 6b 6b 6b 1e 83 ea 28 .........kkk...(
[ 2.677628] Object de858018: 00 00 00 70 1e 85 80 64 ff 73 1d 21 6b 6b 6b 6b ...p...d.s.!kkkk
[ 2.686228] Object de858028: 00 20 00 00 1e 84 17 24 00 10 00 00 1e 85 70 00 . .....$......p.
[ 2.694829] Object de858038: 00 18 00 00 1e 84 17 44 00 08 00 00 1e 83 ea 28 .......D.......(
[ 2.703430] Object de858048: 00 80 00 00 1e 84 f0 00 00 80 00 00 1e 85 70 10 ..............p.
[ 2.712030] Object de858058: 00 20 6b 00 1e 85 80 f4 6b 6b 6b 6b 00 80 02 00 . k.....kkkk....
[ 2.720629] Object de858068: 1e 84 f0 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b ....kkkkkkkkkkkk
[ 2.729230] Object de858078: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2.737830] Object de858088: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2.746429] Object de858098: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2.755029] Object de8580a8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2.763628] Object de8580b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2.772229] Object de8580c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2.780829] Object de8580d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 2.789430] Object de8580e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 73 b0 ea 9f kkkkkkkkkkkks...
[ 2.798030] Object de8580f8: e8 18 80 d6 56 38 44 c0 db e3 4f 71 f7 ce d1 d3 ....V8D...Oq....
[ 2.806629] Redzone de858108: f8 bd 3e 4f ..>O
[ 2.814279] Padding de8581b0: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
[ 2.822283] CPU: 0 PID: 0 Comm: swapper Tainted: G B 4.9.50-g995be12679 #179
[ 2.831819] Call Trace:
[ 2.834301] [dffefd20] [c01aa9a8] check_bytes_and_report+0x100/0x194 (unreliable)
[ 2.841801] [dffefd50] [c01aac3c] check_object+0x200/0x530
[ 2.847306] [dffefd80] [c01ae584] free_debug_processing+0x290/0x690
[ 2.853585] [dffefde0] [c01aec8c] __slab_free+0x308/0x628
[ 2.859000] [dffefe80] [c05057f4] ipsec_esp_encrypt_done+0x130/0x240
[ 2.865378] [dffefeb0] [c05002c4] flush_channel+0x1dc/0x488
[ 2.870968] [dffeff10] [c05007a8] talitos2_done_4ch+0x30/0x200
[ 2.876814] [dffeff30] [c002fe38] tasklet_action+0xa0/0x13c
[ 2.882399] [dffeff60] [c002f118] __do_softirq+0x148/0x6cc
[ 2.887896] [dffeffd0] [c002f954] irq_exit+0xc0/0x124
[ 2.892968] [dffefff0] [c0013adc] call_do_irq+0x24/0x3c
[ 2.898213] [c0d4be00] [c000757c] do_IRQ+0x78/0x108
[ 2.903113] [c0d4be30] [c0015c08] ret_from_except+0x0/0x14
[ 2.908634] --- interrupt: 501 at finish_task_switch+0x70/0x350
[ 2.908634] LR = finish_task_switch+0x58/0x350
[ 2.919327] [c0d4bf20] [c085e1d4] schedule+0x80/0x134
[ 2.924398] [c0d4bf50] [c085e2c0] schedule_preempt_disabled+0x38/0xc8
[ 2.930853] [c0d4bf60] [c007f064] cpu_startup_entry+0xe4/0x190
[ 2.936707] [c0d4bfb0] [c096c434] start_kernel+0x3f4/0x408
[ 2.942198] [c0d4bff0] [00003438] 0x3438
[ 2.946137] FIX dma-kmalloc-256: Restoring 0xde858108-0xde85810b=0xcc
[ 2.946137]
[ 2.954158] FIX dma-kmalloc-256: Object at 0xde858008 not freed
This patch reworks the handling of the CICV out in order
to properly handle all cases.
Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
drivers/crypto/talitos.c | 42 ++++++++++++++++++++++++++++--------------
1 file changed, 28 insertions(+), 14 deletions(-)
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 4dad887ebfa6..df1ed35066c0 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1247,14 +1247,15 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
dma_map_sg(dev, areq->dst, sg_count, DMA_FROM_DEVICE);
}
- sg_count = talitos_sg_map(dev, areq->dst, cryptlen, edesc,
- &desc->ptr[5], sg_count, areq->assoclen,
- tbl_off);
+ ret = talitos_sg_map(dev, areq->dst, cryptlen, edesc, &desc->ptr[5],
+ sg_count, areq->assoclen, tbl_off);
if (desc->hdr & DESC_HDR_TYPE_IPSEC_ESP)
to_talitos_ptr_ext_or(&desc->ptr[5], authsize, is_sec1);
- if (sg_count > 1) {
+ /* ICV data */
+ if (ret > 1) {
+ tbl_off += ret;
edesc->icv_ool = true;
sync_needed = true;
@@ -1264,9 +1265,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
sizeof(struct talitos_ptr) + authsize;
/* Add an entry to the link table for ICV data */
- tbl_ptr += sg_count - 1;
- to_talitos_ptr_ext_set(tbl_ptr, 0, is_sec1);
- tbl_ptr++;
+ to_talitos_ptr_ext_set(tbl_ptr - 1, 0, is_sec1);
to_talitos_ptr_ext_set(tbl_ptr, DESC_PTR_LNKTBL_RETURN,
is_sec1);
to_talitos_ptr_len(tbl_ptr, authsize, is_sec1);
@@ -1274,18 +1273,33 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
/* icv data follows link tables */
to_talitos_ptr(tbl_ptr, edesc->dma_link_tbl + offset,
is_sec1);
+ } else {
+ dma_addr_t addr = edesc->dma_link_tbl;
+
+ if (is_sec1)
+ addr += areq->assoclen + cryptlen;
+ else
+ addr += sizeof(struct talitos_ptr) * tbl_off;
+
+ to_talitos_ptr(&desc->ptr[6], addr, is_sec1);
+ to_talitos_ptr_len(&desc->ptr[6], authsize, is_sec1);
+ }
+ } else if (!(desc->hdr & DESC_HDR_TYPE_IPSEC_ESP)) {
+ ret = talitos_sg_map(dev, areq->dst, authsize, edesc,
+ &desc->ptr[6], sg_count, areq->assoclen +
+ cryptlen,
+ tbl_off);
+ if (ret > 1) {
+ tbl_off += ret;
+ edesc->icv_ool = true;
+ sync_needed = true;
+ } else {
+ edesc->icv_ool = false;
}
} else {
edesc->icv_ool = false;
}
- /* ICV data */
- if (!(desc->hdr & DESC_HDR_TYPE_IPSEC_ESP)) {
- to_talitos_ptr_len(&desc->ptr[6], authsize, is_sec1);
- to_talitos_ptr(&desc->ptr[6], edesc->dma_link_tbl +
- areq->assoclen + cryptlen, is_sec1);
- }
-
/* iv out */
if (desc->hdr & DESC_HDR_TYPE_IPSEC_ESP)
map_single_talitos_ptr(dev, &desc->ptr[6], ivsize, ctx->iv,
--
2.11.0
next prev parent reply other threads:[~2017-12-13 1:56 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-13 1:55 [PATCH AUTOSEL for 4.14 01/60] backlight: pwm_bl: Fix overflow condition alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 02/60] drm: Add retries for lspcon mode detection alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 03/60] clk: sunxi-ng: nm: Check if requested rate is supported by fractional clock alexander.levin
2017-12-13 1:55 ` alexander.levin [this message]
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 06/60] crypto: talitos - fix AEAD test failures alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 05/60] crypto: talitos - fix ctr-aes-talitos alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 04/60] clk: sunxi-ng: sun5i: Fix bit offset of audio PLL post-divider alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 09/60] crypto: lrw - Fix an error handling path in 'create()' alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 08/60] crypto: crypto4xx - increase context and scatter ring buffer elements alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 11/60] kvm, mm: account kvm related kmem slabs to kmemcg alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 10/60] rtc: pl031: make interrupt optional alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 15/60] scsi: mpt3sas: Fix IO error occurs on pulling out a drive from RAID1 volume created on two SATA drive alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 12/60] net: phy: at803x: Change error to EINVAL for invalid MAC alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 13/60] PCI: Avoid bus reset if bridge itself is broken alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 14/60] scsi: cxgb4i: fix Tx skb leak alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 17/60] PM / OPP: Move error message to debug level alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 19/60] Bluetooth: avoid silent hci_bcm ACPI PM regression alexander.levin
2017-12-13 8:14 ` Johan Hovold
2017-12-13 13:37 ` alexander.levin
2017-12-13 14:05 ` Johan Hovold
2017-12-13 14:18 ` alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 16/60] PCI: Create SR-IOV virtfn/physfn links before attaching driver alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 18/60] igb: check memory allocation failure alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 20/60] kbuild: re-order the code to not parse unnecessary variables alexander.levin
2017-12-20 17:13 ` Greg KH
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 21/60] i40e: use the safe hash table iterator when deleting mac filters alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 22/60] iio: st_sensors: add register mask for status register alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 26/60] md: always set THREAD_WAKEUP and wake up wqueue if thread existed alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 25/60] block,bfq: Disable writeback throttling alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 23/60] ixgbe: fix use of uninitialized padding alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 24/60] IB/rxe: check for allocation failure on elem alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 27/60] ip_gre: check packet length and mtu correctly in erspan tx alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 28/60] ipv6: grab rt->rt6i_ref before allocating pcpu rt alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 30/60] Bluetooth: hci_uart_set_flow_control: Fix NULL deref when using serdev alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 29/60] leds: pca955x: Don't invert requested value in pca955x_gpio_set_value() alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 31/60] Bluetooth: hci_bcm: Fix setting of irq trigger type alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 32/60] i40e/i40evf: spread CPU affinity hints across online CPUs only alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 33/60] PCI/AER: Report non-fatal errors only to the affected endpoint alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 34/60] tracing: Exclude 'generic fields' from histograms alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 35/60] percpu: don't forget to free the temporary struct pcpu_alloc_info alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 38/60] powerpc/xmon: Avoid tripping SMP hardlockup watchdog alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 36/60] ASoC: codecs: msm8916-wcd-analog: fix micbias level alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 37/60] ASoC: img-parallel-out: Add pm_runtime_get/put to set_fmt callback alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 41/60] ASoC: codecs: msm8916-wcd-analog: fix module autoload alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 39/60] powerpc/watchdog: Do not trigger SMP crash from touch_nmi_watchdog alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 40/60] sctp: silence warns on sctp_stream_init allocations alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 42/60] fm10k: fix mis-ordered parameters in declaration for .ndo_set_vf_bw alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 43/60] scsi: lpfc: Fix secure firmware updates alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 46/60] i40e: fix client notify of VF reset alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 45/60] scsi: lpfc: Fix warning messages when NVME_TARGET_FC not defined alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 44/60] scsi: lpfc: PLOGI failures during NPIV testing alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 47/60] vfio/pci: Virtualize Maximum Payload Size alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 48/60] ARM: exynos_defconfig: Enable UAS support for Odroid HC1 board alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 50/60] ibmvnic: Set state UP alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 49/60] fm10k: ensure we process SM mbx when processing VF mbx alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 51/60] net: ipv6: send NS for DAD when link operationally up alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 54/60] clk: sunxi-ng: sun6i: Rename HDMI DDC clock to avoid name collision alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 53/60] staging: greybus: light: Release memory obtained by kasprintf alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 52/60] RDMA/hns: Avoid NULL pointer exception alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 55/60] tcp: fix under-evaluated ssthresh in TCP Vegas alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 57/60] cpuidle: fix broadcast control when broadcast can not be entered alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 56/60] rtc: set the alarm to the next expiring timer alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 58/60] drm/vc4: Avoid using vrefresh==0 mode in DSI htotal math alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 59/60] IB/opa_vnic: Properly clear Mac Table Digest alexander.levin
2017-12-13 1:55 ` [PATCH AUTOSEL for 4.14 60/60] IB/opa_vnic: Properly return the total MACs in UC MAC list alexander.levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171213015455.6455-7-alexander.levin@verizon.com \
--to=alexander.levin@verizon.com \
--cc=christophe.leroy@c-s.fr \
--cc=herbert@gondor.apana.org.au \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®