LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
	"Martin K . Petersen" <martin.petersen@oracle.com>,
	Eric Biggers <ebiggers@google.com>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 5.7 12/58] crc-t10dif: Fix potential crypto notify dead-lock
Date: Sat,  8 Aug 2020 19:36:38 -0400
Message-ID: <20200808233724.3618168-12-sashal@kernel.org> (raw)
In-Reply-To: <20200808233724.3618168-1-sashal@kernel.org>

From: Herbert Xu <herbert@gondor.apana.org.au>

[ Upstream commit 3906f640224dbe7714b52b66d7d68c0812808e19 ]

The crypto notify call occurs with a read mutex held so you must
not do any substantial work directly.  In particular, you cannot
call crypto_alloc_* as they may trigger further notifications
which may dead-lock in the presence of another writer.

This patch fixes this by postponing the work into a work queue and
taking the same lock in the module init function.

While we're at it this patch also ensures that all RCU accesses are
marked appropriately (tested with sparse).

Finally this also reveals a race condition in module param show
function as it may be called prior to the module init function.
It's fixed by testing whether crct10dif_tfm is NULL (this is true
iff the init function has not completed assuming fallback is false).

Fixes: 11dcb1037f40 ("crc-t10dif: Allow current transform to be...")
Fixes: b76377543b73 ("crc-t10dif: Pick better transform if one...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/crc-t10dif.c | 54 +++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 42 insertions(+), 12 deletions(-)

diff --git a/lib/crc-t10dif.c b/lib/crc-t10dif.c
index 8cc01a6034165..c9acf1c12cfcb 100644
--- a/lib/crc-t10dif.c
+++ b/lib/crc-t10dif.c
@@ -19,39 +19,46 @@
 static struct crypto_shash __rcu *crct10dif_tfm;
 static struct static_key crct10dif_fallback __read_mostly;
 static DEFINE_MUTEX(crc_t10dif_mutex);
+static struct work_struct crct10dif_rehash_work;
 
-static int crc_t10dif_rehash(struct notifier_block *self, unsigned long val, void *data)
+static int crc_t10dif_notify(struct notifier_block *self, unsigned long val, void *data)
 {
 	struct crypto_alg *alg = data;
-	struct crypto_shash *new, *old;
 
 	if (val != CRYPTO_MSG_ALG_LOADED ||
 	    static_key_false(&crct10dif_fallback) ||
 	    strncmp(alg->cra_name, CRC_T10DIF_STRING, strlen(CRC_T10DIF_STRING)))
 		return 0;
 
+	schedule_work(&crct10dif_rehash_work);
+	return 0;
+}
+
+static void crc_t10dif_rehash(struct work_struct *work)
+{
+	struct crypto_shash *new, *old;
+
 	mutex_lock(&crc_t10dif_mutex);
 	old = rcu_dereference_protected(crct10dif_tfm,
 					lockdep_is_held(&crc_t10dif_mutex));
 	if (!old) {
 		mutex_unlock(&crc_t10dif_mutex);
-		return 0;
+		return;
 	}
 	new = crypto_alloc_shash("crct10dif", 0, 0);
 	if (IS_ERR(new)) {
 		mutex_unlock(&crc_t10dif_mutex);
-		return 0;
+		return;
 	}
 	rcu_assign_pointer(crct10dif_tfm, new);
 	mutex_unlock(&crc_t10dif_mutex);
 
 	synchronize_rcu();
 	crypto_free_shash(old);
-	return 0;
 }
 
 static struct notifier_block crc_t10dif_nb = {
-	.notifier_call = crc_t10dif_rehash,
+	.notifier_call = crc_t10dif_notify,
 };
 
 __u16 crc_t10dif_update(__u16 crc, const unsigned char *buffer, size_t len)
@@ -86,19 +93,26 @@ EXPORT_SYMBOL(crc_t10dif);
 
 static int __init crc_t10dif_mod_init(void)
 {
+	struct crypto_shash *tfm;
+
+	INIT_WORK(&crct10dif_rehash_work, crc_t10dif_rehash);
 	crypto_register_notifier(&crc_t10dif_nb);
-	crct10dif_tfm = crypto_alloc_shash("crct10dif", 0, 0);
-	if (IS_ERR(crct10dif_tfm)) {
+	mutex_lock(&crc_t10dif_mutex);
+	tfm = crypto_alloc_shash("crct10dif", 0, 0);
+	if (IS_ERR(tfm)) {
 		static_key_slow_inc(&crct10dif_fallback);
-		crct10dif_tfm = NULL;
+		tfm = NULL;
 	}
+	RCU_INIT_POINTER(crct10dif_tfm, tfm);
+	mutex_unlock(&crc_t10dif_mutex);
 	return 0;
 }
 
 static void __exit crc_t10dif_mod_fini(void)
 {
 	crypto_unregister_notifier(&crc_t10dif_nb);
-	crypto_free_shash(crct10dif_tfm);
+	cancel_work_sync(&crct10dif_rehash_work);
+	crypto_free_shash(rcu_dereference_protected(crct10dif_tfm, 1));
 }
 
 module_init(crc_t10dif_mod_init);
@@ -106,11 +120,27 @@ module_exit(crc_t10dif_mod_fini);
 
 static int crc_t10dif_transform_show(char *buffer, const struct kernel_param *kp)
 {
+	struct crypto_shash *tfm;
+	const char *name;
+	int len;
+
 	if (static_key_false(&crct10dif_fallback))
 		return sprintf(buffer, "fallback\n");
 
-	return sprintf(buffer, "%s\n",
-		crypto_tfm_alg_driver_name(crypto_shash_tfm(crct10dif_tfm)));
+	rcu_read_lock();
+	tfm = rcu_dereference(crct10dif_tfm);
+	if (!tfm) {
+		len = sprintf(buffer, "init\n");
+		goto unlock;
+	}
+
+	name = crypto_tfm_alg_driver_name(crypto_shash_tfm(tfm));
+	len = sprintf(buffer, "%s\n", name);
+
+unlock:
+	rcu_read_unlock();
+
+	return len;
 }
 
 module_param_call(transform, NULL, crc_t10dif_transform_show, NULL, 0644);
-- 
2.25.1


  parent reply index

Thread overview: 58+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-08 23:36 [PATCH AUTOSEL 5.7 01/58] ARM: dts: stm32: fix uart7_pins_a comments in stm32mp15-pinctrl Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 02/58] x86/mce/inject: Fix a wrong assignment of i_mce.status Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 03/58] perf/x86/intel/uncore: Fix oops when counting IMC uncore events on some TGL Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 04/58] x86, sched: Bail out of frequency invariance if turbo frequency is unknown Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 05/58] x86, sched: Bail out of frequency invariance if turbo_freq/base_freq gives 0 Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 06/58] sched/fair: Fix NOHZ next idle balance Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 07/58] sched: correct SD_flags returned by tl->sd_flags() Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 08/58] arm64: dts: rockchip: fix rk3368-lion gmac reset gpio Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 09/58] arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 10/58] arm64: dts: rockchip: fix rk3399-puma gmac reset gpio Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 11/58] EDAC: Fix reference count leaks Sasha Levin
2020-08-08 23:36 ` Sasha Levin [this message]
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 13/58] arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 14/58] memory: tegra: Fix an error handling path in tegra186_emc_probe() Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 15/58] blktrace: fix debugfs use after free Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 16/58] crypto: ccree - fix resource leak on error path Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 17/58] ARM: exynos: MCPM: Restore big.LITTLE cpuidle support Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 18/58] rcu/tree: Repeat the monitor if any free channel is busy Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 19/58] firmware: arm_scmi: Fix SCMI genpd domain probing Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 20/58] arm64: dts: sun50i-pinephone: dldo4 must not be >= 1.8V Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 21/58] arm64: dts: exynos: Fix silent hang after boot on Espresso Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 22/58] sched/uclamp: Fix initialization of struct uclamp_rq Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 23/58] crypto: qat - allow xts requests not multiple of block Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 24/58] clk: scmi: Fix min and max rate when registering clocks with discrete rates Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 25/58] m68k: mac: Don't send IOP message until channel is idle Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 26/58] m68k: mac: Fix IOP status/control register writes Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 27/58] platform/x86: intel-hid: Fix return value check in check_acpi_dev() Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 28/58] platform/x86: intel-vbtn: " Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 29/58] ARM: dts: gose: Fix ports node name for adv7180 Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 30/58] arm64: dts: renesas: Fix SD Card/eMMC interface device node names Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 31/58] ARM: dts: gose: Fix ports node name for adv7612 Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 32/58] ARM: at91: pm: add missing put_device() call in at91_pm_sram_init() Sasha Levin
2020-08-08 23:36 ` [PATCH AUTOSEL 5.7 33/58] ARM: dts: exynos: Disable frequency scaling for FSYS bus on Odroid XU3 family Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 34/58] reset: intel: fix a compile warning about REG_OFFSET redefined Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 35/58] ARM: dts: sunxi: bananapi-m2-plus-v1.2: Add regulator supply to all CPU cores Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 36/58] ARM: dts: sunxi: bananapi-m2-plus-v1.2: Fix CPU supply voltages Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 37/58] spi: lantiq: fix: Rx overflow error in full duplex mode Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 38/58] tpm: Require that all digests are present in TCG_PCR_EVENT2 structures Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 39/58] recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64 Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 40/58] regulator: fix memory leak on error path of regulator_register() Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 41/58] io_uring: fix sq array offset calculation Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 42/58] arm64: dts: meson: fix mmc0 tuning error on Khadas VIM3 Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 43/58] soc: qcom: pdr: Reorder the PD state indication ack Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 44/58] spi: rockchip: Fix error in SPI slave pio read Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 45/58] ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh() Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 46/58] iocost: Fix check condition of iocg abs_vdebt Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 47/58] scripts/selinux/mdp: fix initial SID handling Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 48/58] irqchip/ti-sci-inta: Fix return value about devm_ioremap_resource() Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 49/58] seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 50/58] md: raid0/linear: fix dereference before null check on pointer mddev Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 51/58] irqchip/loongson-liointc: Fix potential dead lock Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 52/58] irqchip/irq-bcm7038-l1: Guard uses of cpu_logical_map Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 53/58] irqchip/gic-v4.1: Use GFP_ATOMIC flag in allocate_vpe_l1_table() Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 54/58] nvme-tcp: fix controller reset hang during traffic Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 55/58] nvme-rdma: " Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 56/58] nvme-multipath: fix logic for non-optimized paths Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 57/58] nvme-multipath: do not fall back to __nvme_find_path() " Sasha Levin
2020-08-08 23:37 ` [PATCH AUTOSEL 5.7 58/58] block: don't do revalidate zones on invalid devices Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200808233724.3618168-12-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=ebiggers@google.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=linux-kernel@vger.kernel.org \
    --cc=martin.petersen@oracle.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git