All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Andrey Ryabinin <aryabinin@virtuozzo.com>,
	Herbert Xu <herbert@gondor.apana.org.au>
Subject: [PATCH 3.18 18/28] crypto: x86/sha1-mb - fix panic due to unaligned access
Date: Mon, 13 Nov 2017 13:55:12 +0100	[thread overview]
Message-ID: <20171113125402.470624119@linuxfoundation.org> (raw)
In-Reply-To: <20171113125400.803506921@linuxfoundation.org>

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrey Ryabinin <aryabinin@virtuozzo.com>

commit d041b557792c85677f17e08eee535eafbd6b9aa2 upstream.

struct sha1_ctx_mgr allocated in sha1_mb_mod_init() via kzalloc()
and later passed in sha1_mb_flusher_mgr_flush_avx2() function where
instructions vmovdqa used to access the struct. vmovdqa requires
16-bytes aligned argument, but nothing guarantees that struct
sha1_ctx_mgr will have that alignment. Unaligned vmovdqa will
generate GP fault.

Fix this by replacing vmovdqa with vmovdqu which doesn't have alignment
requirements.

Fixes: 2249cbb53ead ("crypto: sha-mb - SHA1 multibuffer submit and flush routines for AVX2")
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S
+++ b/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S
@@ -174,8 +174,8 @@ LABEL skip_ %I
 .endr
 
 	# Find min length
-	vmovdqa _lens+0*16(state), %xmm0
-	vmovdqa _lens+1*16(state), %xmm1
+	vmovdqu _lens+0*16(state), %xmm0
+	vmovdqu _lens+1*16(state), %xmm1
 
 	vpminud %xmm1, %xmm0, %xmm2     # xmm2 has {D,C,B,A}
 	vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}
@@ -195,8 +195,8 @@ LABEL skip_ %I
 	vpsubd  %xmm2, %xmm0, %xmm0
 	vpsubd  %xmm2, %xmm1, %xmm1
 
-	vmovdqa %xmm0, _lens+0*16(state)
-	vmovdqa %xmm1, _lens+1*16(state)
+	vmovdqu %xmm0, _lens+0*16(state)
+	vmovdqu %xmm1, _lens+1*16(state)
 
 	# "state" and "args" are the same address, arg1
 	# len is arg2
@@ -260,8 +260,8 @@ ENTRY(sha1_mb_mgr_get_comp_job_avx2)
 	jc      .return_null
 
 	# Find min length
-	vmovdqa _lens(state), %xmm0
-	vmovdqa _lens+1*16(state), %xmm1
+	vmovdqu _lens(state), %xmm0
+	vmovdqu _lens+1*16(state), %xmm1
 
 	vpminud %xmm1, %xmm0, %xmm2        # xmm2 has {D,C,B,A}
 	vpalignr $8, %xmm2, %xmm3, %xmm3   # xmm3 has {x,x,D,C}

  parent reply	other threads:[~2017-11-13 13:42 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-11-13 12:54 [PATCH 3.18 00/28] 3.18.81-stable review Greg Kroah-Hartman
2017-11-13 12:54 ` [PATCH 3.18 01/28] video: fbdev: pmag-ba-fb: Remove bad `__init annotation Greg Kroah-Hartman
2017-11-13 12:54 ` [PATCH 3.18 02/28] xen/netback: set default upper limit of tx/rx queues to 8 Greg Kroah-Hartman
2017-11-13 12:54 ` [PATCH 3.18 03/28] ARM: dts: imx53-qsb-common: fix FEC pinmux config Greg Kroah-Hartman
2017-11-16  4:08   ` Patrick Brünn
2017-11-13 12:54 ` [PATCH 3.18 05/28] ARM: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6 Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 06/28] iio: trigger: free trigger resource correctly Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 07/28] dt-bindings: Add LEGO MINDSTORMS EV3 compatible specification Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 08/28] dt-bindings: Add vendor prefix for LEGO Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 10/28] serial: sh-sci: Fix register offsets for the IRDA serial port Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 11/28] usb: hcd: initialize hcd->flags to 0 when rm hcd Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 12/28] IPsec: do not ignore crypto err in ah4 input Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 13/28] Input: mpr121 - handle multiple bits change of status register Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 14/28] Input: mpr121 - set missing event capability Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 15/28] IB/ipoib: Change list_del to list_del_init in the tx object Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 16/28] KEYS: trusted: sanitize all key material Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 17/28] KEYS: trusted: fix writing past end of buffer in trusted_read() Greg Kroah-Hartman
2017-11-13 12:55 ` Greg Kroah-Hartman [this message]
2017-11-13 12:55 ` [PATCH 3.18 19/28] KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2] Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 20/28] ARM: 8720/1: ensure dump_instr() checks addr_limit Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 21/28] ALSA: seq: Fix OSS sysex delivery in OSS emulation Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 22/28] ALSA: seq: Avoid invalid lockdep class warning Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 23/28] MIPS: microMIPS: Fix incorrect mask in insn_table_MM Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 24/28] MIPS: Fix CM region target definitions Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 25/28] MIPS: AR7: Ensure that serial ports are properly set up Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 26/28] rbd: use GFP_NOIO for parent stat and data requests Greg Kroah-Hartman
2017-11-13 12:55 ` [PATCH 3.18 28/28] x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context Greg Kroah-Hartman
2017-11-13 21:50 ` [PATCH 3.18 00/28] 3.18.81-stable review Shuah Khan
2017-11-14  7:43   ` Greg Kroah-Hartman
2017-11-13 22:27 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171113125402.470624119@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=aryabinin@virtuozzo.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.