[PATCH for 4.19-stable] padata: fix null pointer deref of pd->pinst

[PATCH for 4.19-stable] padata: fix null pointer deref of pd->pinst

[Daniel Jordan]

The 4.19 backport dc34710a7aba ("padata: Remove broken queue flushing")
removed padata_alloc_pd()'s assignment to pd->pinst, resulting in:

    Unable to handle kernel NULL pointer dereference ...
    ...
    pc : padata_reorder+0x144/0x2e0
    ...
    Call trace:
     padata_reorder+0x144/0x2e0
     padata_do_serial+0xc8/0x128
     pcrypt_aead_enc+0x60/0x70 [pcrypt]
     padata_parallel_worker+0xd8/0x138
     process_one_work+0x1bc/0x4b8
     worker_thread+0x164/0x580
     kthread+0x134/0x138
     ret_from_fork+0x10/0x18

This happened because the backport was based on an enhancement that
moved this assignment but isn't in 4.19:

  bfde23ce200e ("padata: unbind parallel jobs from specific CPUs")

Simply restore the assignment to fix the crash.

Fixes: dc34710a7aba ("padata: Remove broken queue flushing")
Reported-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
---
 kernel/padata.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/padata.c b/kernel/padata.c
index 11c5f9c8779e..cfab62923c45 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -510,6 +510,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,
 	atomic_set(&pd->seq_nr, -1);
 	atomic_set(&pd->reorder_objects, 0);
 	atomic_set(&pd->refcnt, 1);
+	pd->pinst = pinst;
 	spin_lock_init(&pd->lock);
 
 	return pd;
-- 
2.25.0

Re: [PATCH for 4.19-stable] padata: fix null pointer deref of pd->pinst

[Greg Kroah-Hartman]

On Fri, Feb 14, 2020 at 01:28:21PM -0500, Daniel Jordan wrote:
> The 4.19 backport dc34710a7aba ("padata: Remove broken queue flushing")
> removed padata_alloc_pd()'s assignment to pd->pinst, resulting in:
> 
>     Unable to handle kernel NULL pointer dereference ...
>     ...
>     pc : padata_reorder+0x144/0x2e0
>     ...
>     Call trace:
>      padata_reorder+0x144/0x2e0
>      padata_do_serial+0xc8/0x128
>      pcrypt_aead_enc+0x60/0x70 [pcrypt]
>      padata_parallel_worker+0xd8/0x138
>      process_one_work+0x1bc/0x4b8
>      worker_thread+0x164/0x580
>      kthread+0x134/0x138
>      ret_from_fork+0x10/0x18
> 
> This happened because the backport was based on an enhancement that
> moved this assignment but isn't in 4.19:
> 
>   bfde23ce200e ("padata: unbind parallel jobs from specific CPUs")
> 
> Simply restore the assignment to fix the crash.
> 
> Fixes: dc34710a7aba ("padata: Remove broken queue flushing")
> Reported-by: Yang Yingliang <yangyingliang@huawei.com>
> Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Herbert Xu <herbert@gondor.apana.org.au>
> Cc: Sasha Levin <sashal@kernel.org>
> Cc: Steffen Klassert <steffen.klassert@secunet.com>
> Cc: linux-kernel@vger.kernel.org
> Cc: stable@vger.kernel.org
> ---
>  kernel/padata.c | 1 +
>  1 file changed, 1 insertion(+)

Thanks for this, now queued up.

greg k-h

Re: [PATCH for 4.19-stable] padata: fix null pointer deref of pd->pinst

[Sasha Levin]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 645 bytes --]

Hi,

[This is an automated email]

This commit has been processed because it contains a "Fixes:" tag,
fixing commit: dc34710a7aba ("padata: Remove broken queue flushing").

The bot has tested the following trees: v5.5.3, v5.4.19, v4.19.103.

v5.5.3: Build failed! Errors:
    kernel/padata.c:460:4: error: ‘struct parallel_data’ has no member named ‘pinst’

v5.4.19: Build failed! Errors:
    kernel/padata.c:460:4: error: ‘struct parallel_data’ has no member named ‘pinst’

v4.19.103: Build OK!

NOTE: The patch will not be queued to stable trees until it is upstream.

How should we proceed with this patch?

-- 
Thanks,
Sasha

Re: [PATCH for 4.19-stable] padata: fix null pointer deref of pd->pinst

[Yang Yingliang]

Hi,


On 2020/2/15 23:01, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: dc34710a7aba ("padata: Remove broken queue flushing").
>
> The bot has tested the following trees: v5.5.3, v5.4.19, v4.19.103.
>
> v5.5.3: Build failed! Errors:
>      kernel/padata.c:460:4: error: ‘struct parallel_data’ has no member named ‘pinst’
>
> v5.4.19: Build failed! Errors:
>      kernel/padata.c:460:4: error: ‘struct parallel_data’ has no member named ‘pinst’
>
> v4.19.103: Build OK!
>
> NOTE: The patch will not be queued to stable trees until it is upstream.
>
> How should we proceed with this patch?
The commit bbefa1dd6a6d ("crypto: pcrypt - Avoid deadlock by using 
per-instance padata queues") that merged
on linux-5.4.y and linux-5.5.y changes struct parallel_data, so this 
patch it's only needed on linux-4.19.y.
>