1. 20 11月, 2018 4 次提交
  2. 16 11月, 2018 7 次提交
  3. 09 11月, 2018 9 次提交
    • C
      crypto: chelsio - clean up various indentation issues · fc6176a2
      Colin Ian King 提交于
      Trivial fix to clean up varous indentation issue
      Signed-off-by: NColin Ian King <colin.king@canonical.com>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      fc6176a2
    • W
      crypto: cavium/nitrox - fix a DMA pool free failure · 7172122b
      Wenwen Wang 提交于
      In crypto_alloc_context(), a DMA pool is allocated through dma_pool_alloc()
      to hold the crypto context. The meta data of the DMA pool, including the
      pool used for the allocation 'ndev->ctx_pool' and the base address of the
      DMA pool used by the device 'dma', are then stored to the beginning of the
      pool. These meta data are eventually used in crypto_free_context() to free
      the DMA pool through dma_pool_free(). However, given that the DMA pool can
      also be accessed by the device, a malicious device can modify these meta
      data, especially when the device is controlled to deploy an attack. This
      can cause an unexpected DMA pool free failure.
      
      To avoid the above issue, this patch introduces a new structure
      crypto_ctx_hdr and a new field chdr in the structure nitrox_crypto_ctx hold
      the meta data information of the DMA pool after the allocation. Note that
      the original structure ctx_hdr is not changed to ensure the compatibility.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NWenwen Wang <wang6495@umn.edu>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      7172122b
    • Y
      crypto: ccree - add SM3 support · 927574e0
      Yael Chemla 提交于
      Add support for SM3 cipher in CryptoCell 713.
      Signed-off-by: NYael Chemla <yael.chemla@foss.arm.com>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      927574e0
    • Y
      crypto: ccree - modify set_cipher_mode usage from cc_hash · 18a1dc1f
      Yael Chemla 提交于
      encapsulate set_cipher_mode call with another api,
      preparation for specific hash behavior as needed in later patches
      when SM3 introduced.
      Signed-off-by: NYael Chemla <yael.chemla@foss.arm.com>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      18a1dc1f
    • Y
      crypto: ccree - adjust hash length to suit certain context specifics · f1e52fd0
      Yael Chemla 提交于
      Adjust hash length such that it will not be fixed and general for all algs.
      Instead make it suitable for certain context information.
      This is preparation for SM3 support.
      Signed-off-by: NYael Chemla <yael.chemla@foss.arm.com>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      f1e52fd0
    • G
      crypto: ccree - add SM4 support · 9b8d51f8
      Gilad Ben-Yossef 提交于
      Add support for SM4 cipher in CryptoCell 713.
      Signed-off-by: NGilad Ben-Yossef <gilad@benyossef.com>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      9b8d51f8
    • G
      crypto: ccree - add support for CryptoCell 713 · e40fdb50
      Gilad Ben-Yossef 提交于
      Add support for Arm TrustZone CryptoCell 713.
      Note that this patch just enables using a 713 in backwards compatible mode
      to 712. Newer 713 specific features will follow.
      Signed-off-by: NGilad Ben-Yossef <gilad@benyossef.com>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      e40fdb50
    • J
      crypto: hisilicon - Fix reference after free of memories on error path · 0b0cf6af
      John Garry 提交于
      coccicheck currently warns of the following issues in the driver:
      drivers/crypto/hisilicon/sec/sec_algs.c:864:51-66: ERROR: reference preceded by free on line 812
      drivers/crypto/hisilicon/sec/sec_algs.c:864:40-49: ERROR: reference preceded by free on line 813
      drivers/crypto/hisilicon/sec/sec_algs.c:861:8-24: ERROR: reference preceded by free on line 814
      drivers/crypto/hisilicon/sec/sec_algs.c:860:41-51: ERROR: reference preceded by free on line 815
      drivers/crypto/hisilicon/sec/sec_algs.c:867:7-18: ERROR: reference preceded by free on line 816
      
      It would appear than on certain error paths that we may attempt reference-
      after-free some memories.
      
      This patch fixes those issues. The solution doesn't look perfect, but
      having same memories free'd possibly from separate functions makes it
      tricky.
      
      Fixes: 915e4e84 ("crypto: hisilicon - SEC security accelerator driver")
      Reviewed-by: NJonathan Cameron <Jonathan.Cameron@huawei.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NJohn Garry <john.garry@huawei.com>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      0b0cf6af
    • J
      crypto: hisilicon - Fix NULL dereference for same dst and src · 68a031d2
      John Garry 提交于
      When the source and destination addresses for the cipher are the same, we
      will get a NULL dereference from accessing the split destination
      scatterlist memories, as shown:
      
      [   56.565719] tcrypt:
      [   56.565719] testing speed of async ecb(aes) (hisi_sec_aes_ecb) encryption
      [   56.574683] tcrypt: test 0 (128 bit key, 16 byte blocks):
      [   56.587585] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
      [   56.596361] Mem abort info:
      [   56.599151]   ESR = 0x96000006
      [   56.602196]   Exception class = DABT (current EL), IL = 32 bits
      [   56.608105]   SET = 0, FnV = 0
      [   56.611149]   EA = 0, S1PTW = 0
      [   56.614280] Data abort info:
      [   56.617151]   ISV = 0, ISS = 0x00000006
      [   56.620976]   CM = 0, WnR = 0
      [   56.623930] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
      [   56.630533] [0000000000000000] pgd=0000041fc7e4d003, pud=0000041fcd9bf003, pmd=0000000000000000
      [   56.639224] Internal error: Oops: 96000006 [#1] PREEMPT SMP
      [   56.644782] Modules linked in: tcrypt(+)
      [   56.648695] CPU: 21 PID: 2326 Comm: insmod Tainted: G        W         4.19.0-rc6-00001-g3fabfb8-dirty #716
      [   56.658420] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT17 Nemo 2.0 RC0 10/05/2018
      [   56.667537] pstate: 20000005 (nzCv daif -PAN -UAO)
      [   56.672322] pc : sec_alg_skcipher_crypto+0x318/0x748
      [   56.677274] lr : sec_alg_skcipher_crypto+0x178/0x748
      [   56.682224] sp : ffff0000118e3840
      [   56.685525] x29: ffff0000118e3840 x28: ffff841fbb3f8118
      [   56.690825] x27: 0000000000000000 x26: 0000000000000000
      [   56.696125] x25: ffff841fbb3f8080 x24: ffff841fbadc0018
      [   56.701425] x23: ffff000009119000 x22: ffff841fbb24e280
      [   56.706724] x21: ffff841ff212e780 x20: ffff841ff212e700
      [   56.712023] x19: 0000000000000001 x18: ffffffffffffffff
      [   56.717322] x17: 0000000000000000 x16: 0000000000000000
      [   56.722621] x15: ffff0000091196c8 x14: 72635f7265687069
      [   56.727920] x13: 636b735f676c615f x12: ffff000009119940
      [   56.733219] x11: 0000000000000000 x10: 00000000006080c0
      [   56.738519] x9 : 0000000000000000 x8 : ffff841fbb24e480
      [   56.743818] x7 : ffff841fbb24e500 x6 : ffff841ff00cdcc0
      [   56.749117] x5 : 0000000000000010 x4 : 0000000000000000
      [   56.754416] x3 : ffff841fbb24e380 x2 : ffff841fbb24e480
      [   56.759715] x1 : 0000000000000000 x0 : ffff000008f682c8
      [   56.765016] Process insmod (pid: 2326, stack limit = 0x(____ptrval____))
      [   56.771702] Call trace:
      [   56.774136]  sec_alg_skcipher_crypto+0x318/0x748
      [   56.778740]  sec_alg_skcipher_encrypt+0x10/0x18
      [   56.783259]  test_skcipher_speed+0x2a0/0x700 [tcrypt]
      [   56.788298]  do_test+0x18f8/0x48c8 [tcrypt]
      [   56.792469]  tcrypt_mod_init+0x60/0x1000 [tcrypt]
      [   56.797161]  do_one_initcall+0x5c/0x178
      [   56.800985]  do_init_module+0x58/0x1b4
      [   56.804721]  load_module+0x1da4/0x2150
      [   56.808456]  __se_sys_init_module+0x14c/0x1e8
      [   56.812799]  __arm64_sys_init_module+0x18/0x20
      [   56.817231]  el0_svc_common+0x60/0xe8
      [   56.820880]  el0_svc_handler+0x2c/0x80
      [   56.824615]  el0_svc+0x8/0xc
      [   56.827483] Code: a94c87a3 910b2000 f87b7842 f9004ba2 (b87b7821)
      [   56.833564] ---[ end trace 0f63290590e93d94 ]---
      Segmentation fault
      
      Fix this by only accessing these memories when we have different src and
      dst.
      
      Fixes: 915e4e84 ("crypto: hisilicon - SEC security accelerator driver")
      Reviewed-by: NJonathan Cameron <Jonathan.Cameron@huawei.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NJohn Garry <john.garry@huawei.com>
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      68a031d2
  4. 03 11月, 2018 3 次提交
  5. 02 11月, 2018 5 次提交
    • K
      nvme-pci: fix conflicting p2p resource adds · 9fe5c59f
      Keith Busch 提交于
      The nvme pci driver had been adding its CMB resource to the P2P DMA
      subsystem everytime on on a controller reset. This results in the
      following warning:
      
          ------------[ cut here ]------------
          nvme 0000:00:03.0: Conflicting mapping in same section
          WARNING: CPU: 7 PID: 81 at kernel/memremap.c:155 devm_memremap_pages+0xa6/0x380
          ...
          Call Trace:
           pci_p2pdma_add_resource+0x153/0x370
           nvme_reset_work+0x28c/0x17b1 [nvme]
           ? add_timer+0x107/0x1e0
           ? dequeue_entity+0x81/0x660
           ? dequeue_entity+0x3b0/0x660
           ? pick_next_task_fair+0xaf/0x610
           ? __switch_to+0xbc/0x410
           process_one_work+0x1cf/0x350
           worker_thread+0x215/0x3d0
           ? process_one_work+0x350/0x350
           kthread+0x107/0x120
           ? kthread_park+0x80/0x80
           ret_from_fork+0x1f/0x30
          ---[ end trace f7ea76ac6ee72727 ]---
          nvme nvme0: failed to register the CMB
      
      This patch fixes this by registering the CMB with P2P only once.
      Signed-off-by: NKeith Busch <keith.busch@intel.com>
      Reviewed-by: NLogan Gunthorpe <logang@deltatee.com>
      Signed-off-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      9fe5c59f
    • J
      nvme-fc: fix request private initialization · d19b8bc8
      James Smart 提交于
      The patch made to avoid Coverity reporting of out of bounds access
      on aen_op moved the assignment of a pointer, leaving it null when it
      was subsequently used to calculate a private pointer. Thus the private
      pointer was bad.
      
      Move/correct the private pointer initialization to be in sync with the
      patch.
      
      Fixes: 0d2bdf9f ("nvme-fc: rework the request initialization code")
      Signed-off-by: NJames Smart <jsmart2021@gmail.com>
      Reviewed-by: NSagi Grimberg <sagi@grimberg.me>
      Signed-off-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      d19b8bc8
    • D
      blkcg: revert blkcg cleanups series · b5f2954d
      Dennis Zhou 提交于
      This reverts a series committed earlier due to null pointer exception
      bug report in [1]. It seems there are edge case interactions that I did
      not consider and will need some time to understand what causes the
      adverse interactions.
      
      The original series can be found in [2] with a follow up series in [3].
      
      [1] https://www.spinics.net/lists/cgroups/msg20719.html
      [2] https://lore.kernel.org/lkml/20180911184137.35897-1-dennisszhou@gmail.com/
      [3] https://lore.kernel.org/lkml/20181020185612.51587-1-dennis@kernel.org/
      
      This reverts the following commits:
      d459d853, b2c3fa54, 101246ec, b3b9f24f, e2b09899,
      f0fcb3ec, c839e7a0, bdc24917, 74b7c02a, 5bf9a1f3,
      a7b39b4e, 07b05bcc, 49f4c2dc, 27e6fa99Signed-off-by: NDennis Zhou <dennis@kernel.org>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      b5f2954d
    • M
      block: brd: associate with queue until adding disk · 153fcd5f
      Ming Lei 提交于
      brd_free() may be called in failure path on one brd instance which
      disk isn't added yet, so release handler of gendisk may free the
      associated request_queue early and causes the following use-after-free[1].
      
      This patch fixes this issue by associating gendisk with request_queue
      just before adding disk.
      
      [1] KASAN: use-after-free Read in del_timer_syncNon-volatile memory driver v1.3
      Linux agpgart interface v0.103
      [drm] Initialized vgem 1.0.0 20120112 for virtual device on minor 0
      usbcore: registered new interface driver udl
      ==================================================================
      BUG: KASAN: use-after-free in __lock_acquire+0x36d9/0x4c20
      kernel/locking/lockdep.c:3218
      Read of size 8 at addr ffff8801d1b6b540 by task swapper/0/1
      
      CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.0+ #88
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
      Google 01/01/2011
      Call Trace:
        __dump_stack lib/dump_stack.c:77 [inline]
        dump_stack+0x244/0x39d lib/dump_stack.c:113
        print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256
        kasan_report_error mm/kasan/report.c:354 [inline]
        kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412
        __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
        __lock_acquire+0x36d9/0x4c20 kernel/locking/lockdep.c:3218
        lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844
        del_timer_sync+0xb7/0x270 kernel/time/timer.c:1283
        blk_cleanup_queue+0x413/0x710 block/blk-core.c:809
        brd_free+0x5d/0x71 drivers/block/brd.c:422
        brd_init+0x2eb/0x393 drivers/block/brd.c:518
        do_one_initcall+0x145/0x957 init/main.c:890
        do_initcall_level init/main.c:958 [inline]
        do_initcalls init/main.c:966 [inline]
        do_basic_setup init/main.c:984 [inline]
        kernel_init_freeable+0x5c6/0x6b9 init/main.c:1148
        kernel_init+0x11/0x1ae init/main.c:1068
        ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:350
      
      Reported-by: syzbot+3701447012fe951dabb2@syzkaller.appspotmail.com
      Signed-off-by: NMing Lei <ming.lei@redhat.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      153fcd5f
    • R
      of: Fix cpu node iterator to not ignore disabled cpu nodes · c961cb3b
      Rob Herring 提交于
      In most cases, nodes with 'status = "disabled";' are treated as if the
      node is not present though it is a common bug to forget to check that.
      However, cpu nodes are different in that "disabled" simply means offline
      and the OS can bring the CPU core online. Commit f1f207e4 ("of: Add
      cpu node iterator for_each_of_cpu_node()") followed the common behavior
      of ignoring disabled cpu nodes. This breaks some powerpc systems (at
      least NXP P50XX/e5500). Fix this by dropping the status check.
      
      Fixes: 651d44f9 ("of: use for_each_of_cpu_node iterator")
      Fixes: f1f207e4 ("of: Add cpu node iterator for_each_of_cpu_node()")
      Reported-by: NChristian Zigotzky <chzigotzky@xenosoft.de>
      Tested-by: NMichael Ellerman <mpe@ellerman.id.au>
      Cc: Frank Rowand <frowand.list@gmail.com>
      Signed-off-by: NRob Herring <robh@kernel.org>
      c961cb3b
  6. 01 11月, 2018 12 次提交