linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	"Herbert Xu" <herbert@gondor.apana.org.au>,
	"Horia Geantă" <horia.geanta@nxp.com>
Subject: [PATCH 4.4 23/79] crypto: caam - fix concurrency issue in givencrypt descriptor
Date: Wed, 16 Oct 2019 14:49:58 -0700	[thread overview]
Message-ID: <20191016214752.249557377@linuxfoundation.org> (raw)
In-Reply-To: <20191016214729.758892904@linuxfoundation.org>

From: Horia Geantă <horia.geanta@nxp.com>

commit 48f89d2a2920166c35b1c0b69917dbb0390ebec7 upstream.

IV transfer from ofifo to class2 (set up at [29][30]) is not guaranteed
to be scheduled before the data transfer from ofifo to external memory
(set up at [38]:

[29] 10FA0004           ld: ind-nfifo (len=4) imm
[30] 81F00010               <nfifo_entry: ofifo->class2 type=msg len=16>
[31] 14820004           ld: ccb2-datasz len=4 offs=0 imm
[32] 00000010               data:0x00000010
[33] 8210010D    operation: cls1-op aes cbc init-final enc
[34] A8080B04         math: (seqin + math0)->vseqout len=4
[35] 28000010    seqfifold: skip len=16
[36] A8080A04         math: (seqin + math0)->vseqin len=4
[37] 2F1E0000    seqfifold: both msg1->2-last2-last1 len=vseqinsz
[38] 69300000   seqfifostr: msg len=vseqoutsz
[39] 5C20000C      seqstr: ccb2 ctx len=12 offs=0

If ofifo -> external memory transfer happens first, DECO will hang
(issuing a Watchdog Timeout error, if WDOG is enabled) waiting for
data availability in ofifo for the ofifo -> c2 ififo transfer.

Make sure IV transfer happens first by waiting for all CAAM internal
transfers to end before starting payload transfer.

New descriptor with jump command inserted at [37]:

[..]
[36] A8080A04         math: (seqin + math0)->vseqin len=4
[37] A1000401         jump: jsl1 all-match[!nfifopend] offset=[01] local->[38]
[38] 2F1E0000    seqfifold: both msg1->2-last2-last1 len=vseqinsz
[39] 69300000   seqfifostr: msg len=vseqoutsz
[40] 5C20000C      seqstr: ccb2 ctx len=12 offs=0

[Note: the issue is present in the descriptor from the very beginning
(cf. Fixes tag). However I've marked it v4.19+ since it's the oldest
maintained kernel that the patch applies clean against.]

Cc: <stable@vger.kernel.org> # v4.19+
Fixes: 1acebad3d8db8 ("crypto: caam - faster aead implementation")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[Horia: backport to v4.4, v4.9]
Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/crypto/caam/caamalg.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -75,7 +75,7 @@
 #define DESC_AEAD_BASE			(4 * CAAM_CMD_SZ)
 #define DESC_AEAD_ENC_LEN		(DESC_AEAD_BASE + 11 * CAAM_CMD_SZ)
 #define DESC_AEAD_DEC_LEN		(DESC_AEAD_BASE + 15 * CAAM_CMD_SZ)
-#define DESC_AEAD_GIVENC_LEN		(DESC_AEAD_ENC_LEN + 9 * CAAM_CMD_SZ)
+#define DESC_AEAD_GIVENC_LEN		(DESC_AEAD_ENC_LEN + 10 * CAAM_CMD_SZ)
 
 /* Note: Nonce is counted in enckeylen */
 #define DESC_AEAD_CTR_RFC3686_LEN	(4 * CAAM_CMD_SZ)
@@ -437,6 +437,7 @@ static int aead_set_sh_desc(struct crypt
 	u32 geniv, moveiv;
 	u32 ctx1_iv_off = 0;
 	u32 *desc;
+	u32 *wait_cmd;
 	const bool ctr_mode = ((ctx->class1_alg_type & OP_ALG_AAI_MASK) ==
 			       OP_ALG_AAI_CTR_MOD128);
 	const bool is_rfc3686 = alg->caam.rfc3686;
@@ -702,6 +703,14 @@ copy_iv:
 
 	/* Will read cryptlen */
 	append_math_add(desc, VARSEQINLEN, SEQINLEN, REG0, CAAM_CMD_SZ);
+
+	/*
+	 * Wait for IV transfer (ofifo -> class2) to finish before starting
+	 * ciphertext transfer (ofifo -> external memory).
+	 */
+	wait_cmd = append_jump(desc, JUMP_JSL | JUMP_TEST_ALL | JUMP_COND_NIFP);
+	set_jump_tgt_here(desc, wait_cmd);
+
 	append_seq_fifo_load(desc, 0, FIFOLD_CLASS_BOTH | KEY_VLF |
 			     FIFOLD_TYPE_MSG1OUT2 | FIFOLD_TYPE_LASTBOTH);
 	append_seq_fifo_store(desc, 0, FIFOST_TYPE_MESSAGE_DATA | KEY_VLF);



  parent reply	other threads:[~2019-10-16 21:53 UTC|newest]

Thread overview: 86+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-16 21:49 [PATCH 4.4 00/79] 4.4.197-stable review Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 01/79] KVM: s390: Test for bad access register and size at the start of S390_MEM_OP Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 02/79] s390/topology: avoid firing events before kobjs are created Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 03/79] s390/cio: avoid calling strlen on null pointer Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 04/79] s390/cio: exclude subchannels with no parent from pseudo check Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 05/79] KVM: nVMX: handle page fault in vmread fix Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 06/79] ASoC: Define a set of DAPM pre/post-up events Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 07/79] powerpc/powernv: Restrict OPAL symbol map to only be readable by root Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 08/79] can: mcp251x: mcp251x_hw_reset(): allow more time after a reset Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 09/79] crypto: qat - Silence smp_processor_id() warning Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 10/79] ieee802154: atusb: fix use-after-free at disconnect Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 11/79] cfg80211: initialize on-stack chandefs Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 12/79] ima: always return negative code for error Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 13/79] fs: nfs: Fix possible null-pointer dereferences in encode_attrs() Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 14/79] 9p: avoid attaching writeback_fid on mmap with type PRIVATE Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 15/79] xen/pci: reserve MCFG areas earlier Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 16/79] ceph: fix directories inode i_blkbits initialization Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 17/79] drm/amdgpu: Check for valid number of registers to read Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 18/79] thermal: Fix use-after-free when unregistering thermal zone device Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 19/79] fuse: fix memleak in cuse_channel_open Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 20/79] kernel/elfcore.c: include proper prototypes Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 21/79] tools lib traceevent: Do not free tep->cmdlines in add_new_comm() on failure Greg Kroah-Hartman
2019-10-16 21:49 ` [PATCH 4.4 22/79] perf stat: Fix a segmentation fault when using repeat forever Greg Kroah-Hartman
2019-10-16 21:49 ` Greg Kroah-Hartman [this message]
2019-10-16 21:49 ` [PATCH 4.4 24/79] cfg80211: add and use strongly typed element iteration macros Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 25/79] cfg80211: Use const more consistently in for_each_element macros Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 26/79] nl80211: validate beacon head Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 27/79] ASoC: sgtl5000: Improve VAG power and mute control Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 28/79] panic: ensure preemption is disabled during panic() Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 29/79] USB: rio500: Remove Rio 500 kernel driver Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 30/79] USB: yurex: Dont retry on unexpected errors Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 31/79] USB: yurex: fix NULL-derefs on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 32/79] USB: usb-skeleton: fix runtime PM after driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 33/79] USB: usb-skeleton: fix NULL-deref on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 34/79] xhci: Prevent device initiated U1/U2 link pm if exit latency is too long Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 35/79] xhci: Check all endpoints for LPM timeout Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 36/79] usb: xhci: wait for CNR controller not ready bit in xhci resume Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 37/79] xhci: Increase STS_SAVE timeout in xhci_suspend() Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 38/79] USB: adutux: remove redundant variable minor Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 39/79] USB: adutux: fix use-after-free on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 40/79] USB: adutux: fix NULL-derefs " Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 41/79] USB: adutux: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 42/79] USB: iowarrior: fix use-after-free on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 43/79] USB: iowarrior: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 44/79] USB: iowarrior: fix use-after-free after driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 45/79] USB: usblp: fix runtime PM " Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 46/79] USB: chaoskey: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 47/79] USB: ldusb: fix NULL-derefs on driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 48/79] serial: uartlite: fix exit path null pointer Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 49/79] USB: serial: keyspan: fix NULL-derefs on open() and write() Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 50/79] USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 51/79] USB: serial: option: add Telit FN980 compositions Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 52/79] USB: serial: option: add support for Cinterion CLS8 devices Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 53/79] USB: serial: fix runtime PM after driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 54/79] USB: usblcd: fix I/O after disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 55/79] USB: microtek: fix info-leak at probe Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 56/79] USB: dummy-hcd: fix power budget for SuperSpeed mode Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 57/79] usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}() Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 58/79] usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 59/79] USB: legousbtower: fix slab info leak at probe Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 60/79] USB: legousbtower: fix deadlock on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 61/79] USB: legousbtower: fix potential NULL-deref " Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 62/79] USB: legousbtower: fix open after failed reset request Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 63/79] USB: legousbtower: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 64/79] staging: vt6655: Fix memory leak in vt6655_probe Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 65/79] iio: adc: ad799x: fix probe error handling Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 66/79] iio: light: opt3001: fix mutex unlock race Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 67/79] perf llvm: Dont access out-of-scope array Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 68/79] CIFS: Gracefully handle QueryInfo errors during open Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 69/79] CIFS: Force reval dentry if LOOKUP_REVAL flag is set Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 70/79] kernel/sysctl.c: do not override max_threads provided by userspace Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 71/79] arm64: capabilities: Handle sign of the feature bit Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 72/79] arm64: Rename cpuid_feature field extract routines Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 73/79] Staging: fbtft: fix memory leak in fbtft_framebuffer_alloc Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 74/79] cifs: Check uniqueid for SMB2+ and return -ESTALE if necessary Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 75/79] CIFS: Force revalidate inode when dentry is stale Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 76/79] media: stkwebcam: fix runtime PM after driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 77/79] tracing: Get trace_array reference for available_tracers files Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 78/79] x86/asm: Fix MWAITX C-state hint value Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.4 79/79] xfs: clear sb->s_fs_info on mount failure Greg Kroah-Hartman
2019-10-17  1:42 ` [PATCH 4.4 00/79] 4.4.197-stable review kernelci.org bot
2019-10-17 14:40 ` shuah
2019-10-17 18:02 ` Guenter Roeck
2019-10-17 18:18 ` Didik Setiawan
2019-10-17 20:02 ` Naresh Kamboju
2019-10-18  7:55 ` Jon Hunter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191016214752.249557377@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=horia.geanta@nxp.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).