1. 20 8月, 2013 1 次提交
  2. 10 7月, 2013 2 次提交
    • V
      crypto: caam - Fixed the memory out of bound overwrite issue · 9c23b7d3
      Vakul Garg 提交于
      When kernel is compiled with CONFIG_SLUB_DEBUG=y and
      CRYPTO_MANAGER_DISABLE_TESTS=n, during kernel bootup, the kernel
      reports error given below. The root cause is that in function
      hash_digest_key(), for allocating descriptor, insufficient memory was
      being allocated. The required number of descriptor words apart from
      input and output pointers are 8 (instead of 6).
      
      =============================================================================
      BUG dma-kmalloc-32 (Not tainted): Redzone overwritten
      -----------------------------------------------------------------------------
      
      Disabling lock debugging due to kernel taint
      INFO: 0xdec5dec0-0xdec5dec3. First byte 0x0 instead of 0xcc
      INFO: Allocated in ahash_setkey+0x60/0x594 age=7 cpu=1 pid=1257
              __kmalloc+0x154/0x1b4
              ahash_setkey+0x60/0x594
              test_hash+0x260/0x5a0
              alg_test_hash+0x48/0xb0
              alg_test+0x84/0x228
              cryptomgr_test+0x4c/0x54
              kthread+0x98/0x9c
              ret_from_kernel_thread+0x64/0x6c
      INFO: Slab 0xc0bd0ba0 objects=19 used=2 fp=0xdec5d0d0 flags=0x0081
      INFO: Object 0xdec5dea0 @offset=3744 fp=0x5c200014
      
      Bytes b4 dec5de90: 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a
      ........ZZZZZZZZ
      Object dec5dea0: b0 80 00 0a 84 41 00 0d f0 40 00 00 00 67 3f c0
      .....A...@...g?.
      Object dec5deb0: 00 00 00 50 2c 14 00 50 f8 40 00 00 1e c5 d0 00
      ...P,..P.@......
      Redzone dec5dec0: 00 00 00 14                                      ....
      Padding dec5df68: 5a 5a 5a 5a 5a 5a 5a 5a
      ZZZZZZZZ
      Call Trace:
      [dec65b60] [c00071b4] show_stack+0x4c/0x168 (unreliable)
      [dec65ba0] [c00d4ec8] check_bytes_and_report+0xe4/0x11c
      [dec65bd0] [c00d507c] check_object+0x17c/0x23c
      [dec65bf0] [c0550a00] free_debug_processing+0xf4/0x294
      [dec65c20] [c0550bdc] __slab_free+0x3c/0x294
      [dec65c80] [c03f0744] ahash_setkey+0x4e0/0x594
      [dec65cd0] [c01ef138] test_hash+0x260/0x5a0
      [dec65e50] [c01ef4c0] alg_test_hash+0x48/0xb0
      [dec65e70] [c01eecc4] alg_test+0x84/0x228
      [dec65ee0] [c01ec640] cryptomgr_test+0x4c/0x54
      [dec65ef0] [c005adc0] kthread+0x98/0x9c
      [dec65f40] [c000e1ac] ret_from_kernel_thread+0x64/0x6c
      FIX dma-kmalloc-32: Restoring 0xdec5dec0-0xdec5dec3=0xcc
      
      Change-Id: I0c7a1048053e811025d1c3b487940f87345c8f5d
      Signed-off-by: NVakul Garg <vakul@freescale.com>
      CC: <stable@vger.kernel.org> #3.9
      Reviewed-by: NGeanta Neag Horia Ioan-B05471 <horia.geanta@freescale.com>
      Reviewed-by: NFleming Andrew-AFLEMING <AFLEMING@freescale.com>
      Tested-by: NFleming Andrew-AFLEMING <AFLEMING@freescale.com>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      9c23b7d3
    • A
      crypto: talitos: use sg_pcopy_to_buffer() · d0525723
      Akinobu Mita 提交于
      Use sg_pcopy_to_buffer() which is better than the function previously used.
      Because it doesn't do kmap/kunmap for skipped pages.
      Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: "James E.J. Bottomley" <JBottomley@parallels.com>
      Cc: Douglas Gilbert <dgilbert@interlog.com>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Horia Geanta <horia.geanta@freescale.com>
      Cc: Imre Deak <imre.deak@intel.com>
      Cc: Tejun Heo <tj@kernel.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      d0525723
  3. 25 6月, 2013 6 次提交
  4. 05 6月, 2013 7 次提交
  5. 28 5月, 2013 11 次提交
  6. 27 5月, 2013 2 次提交
  7. 24 5月, 2013 10 次提交
  8. 14 5月, 2013 1 次提交