Mark Salter f1702e2047 crypto: ccp - fix uninitialized list head ... commit 691505a803 upstream. A NULL-pointer dereference was reported in fedora bz#1762199 while reshaping a raid6 array after adding a fifth drive to an existing array. [ 47.343549] md/raid:md0: raid level 6 active with 3 out of 5 devices, algorithm 2 [ 47.804017] md0: detected capacity change from 0 to 7885289422848 [ 47.822083] Unable to handle kernel read from unreadable memory at virtual address 0000000000000000 ... [ 47.940477] CPU: 1 PID: 14210 Comm: md0_raid6 Tainted: G W 5.2.18-200.fc30.aarch64 #1 [ 47.949594] Hardware name: AMD Overdrive/Supercharger/To be filled by O.E.M., BIOS ROD1002C 04/08/2016 [ 47.958886] pstate: 00400085 (nzcv daIf +PAN -UAO) [ 47.963668] pc : __list_del_entry_valid+0x2c/0xa8 [ 47.968366] lr : ccp_tx_submit+0x84/0x168 [ccp] [ 47.972882] sp : ffff00001369b970 [ 47.976184] x29: ffff00001369b970 x28: ffff00001369bdb8 [ 47.981483] x27: 00000000ffffffff x26: ffff8003b758af70 [ 47.986782] x25: ffff8003b758b2d8 x24: ffff8003e6245818 [ 47.992080] x23: 0000000000000000 x22: ffff8003e62450c0 [ 47.997379] x21: ffff8003dfd6add8 x20: 0000000000000003 [ 48.002678] x19: ffff8003e6245100 x18: 0000000000000000 [ 48.007976] x17: 0000000000000000 x16: 0000000000000000 [ 48.013274] x15: 0000000000000000 x14: 0000000000000000 [ 48.018572] x13: ffff7e000ef83a00 x12: 0000000000000001 [ 48.023870] x11: ffff000010eff998 x10: 00000000000019a0 [ 48.029169] x9 : 0000000000000000 x8 : ffff8003e6245180 [ 48.034467] x7 : 0000000000000000 x6 : 000000000000003f [ 48.039766] x5 : 0000000000000040 x4 : ffff8003e0145080 [ 48.045064] x3 : dead000000000200 x2 : 0000000000000000 [ 48.050362] x1 : 0000000000000000 x0 : ffff8003e62450c0 [ 48.055660] Call trace: [ 48.058095] __list_del_entry_valid+0x2c/0xa8 [ 48.062442] ccp_tx_submit+0x84/0x168 [ccp] [ 48.066615] async_tx_submit+0x224/0x368 [async_tx] [ 48.071480] async_trigger_callback+0x68/0xfc [async_tx] [ 48.076784] ops_run_biofill+0x178/0x1e8 [raid456] [ 48.081566] raid_run_ops+0x248/0x818 [raid456] [ 48.086086] handle_stripe+0x864/0x1208 [raid456] [ 48.090781] handle_active_stripes.isra.0+0xb0/0x278 [raid456] [ 48.096604] raid5d+0x378/0x618 [raid456] [ 48.100602] md_thread+0xa0/0x150 [ 48.103905] kthread+0x104/0x130 [ 48.107122] ret_from_fork+0x10/0x18 [ 48.110686] Code: d2804003 f2fbd5a3 eb03003f 54000320 (f9400021) [ 48.116766] ---[ end trace 23f390a527f7ad77 ]--- ccp_tx_submit is passed a dma_async_tx_descriptor which is contained in a ccp_dma_desc and adds it to a ccp channel's pending list: list_del(&desc->entry); list_add_tail(&desc->entry, &chan->pending); The problem is that desc->entry may be uninitialized in the async_trigger_callback path where the descriptor was gotten from ccp_prep_dma_interrupt which got it from ccp_alloc_dma_desc which doesn't initialize the desc->entry list head. So, just initialize the list head to avoid the problem. Cc: <stable@vger.kernel.org> Reported-by: Sahaj Sarup <sahajsarup@gmail.com> Signed-off-by: Mark Salter <msalter@redhat.com> Acked-by: Gary R Hook <gary.hook@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-12-13 08:43:08 +01:00
..
amcc	crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr	2019-12-13 08:43:04 +01:00
axis	crypto: artpec6 - use devm_platform_ioremap_resource() to simplify code	2019-08-09 15:11:58 +10:00
bcm	crypto: bcm/des - switch to new verification routines	2019-08-22 14:39:38 +10:00
caam	crypto: caam - Cast to long first before pointer conversion	2019-09-13 21:20:47 +10:00
cavium	crypto: cavium/zip - Add missing single_release()	2019-09-09 23:48:41 +10:00
ccp	crypto: ccp - fix uninitialized list head	2019-12-13 08:43:08 +01:00
ccree	crypto: ccree - enable CTS support in AES-XTS	2019-09-13 21:17:58 +10:00
chelsio	inet: stop leaking jiffies on the wire	2019-11-01 14:57:52 -07:00
hisilicon	crypto: hisilicon - avoid unused function warning	2019-09-20 23:05:33 +10:00
inside-secure	crypto: inside-secure - Fix stability issue with Macchiatobin	2019-12-04 22:30:44 +01:00
marvell	crypto: marvell - Use kzfree rather than its implementation	2019-09-09 23:48:40 +10:00
mediatek	crypto: mediatek - fix incorrect crypto key setting	2019-09-05 14:36:54 +10:00
nx	crypto: nx - remove unused variables 'nx_driver_string' and 'nx_driver_version'	2019-08-30 18:05:31 +10:00
qat	crypto: qat - Silence smp_processor_id() warning	2019-08-02 14:44:00 +10:00
qce	crypto: qce/des - switch to new verification routines	2019-08-22 14:57:32 +10:00
rockchip	crypto: rk3288/des - switch to new verification routines	2019-08-22 14:57:32 +10:00
stm32	crypto: des - split off DES library from generic DES cipher driver	2019-08-22 14:57:33 +10:00
sunxi-ss	crypto: sun4i/des - switch to new verification routines	2019-08-22 14:57:32 +10:00
ux500	crypto: ux500 - Fix COMPILE_TEST warnings	2019-09-09 23:48:41 +10:00
virtio	crypto: drivers - Use kmemdup rather than duplicating its implementation	2019-07-26 15:03:59 +10:00
vmx	crypto: vmx/xts - use fallback for ciphertext stealing	2019-08-22 14:57:34 +10:00
Kconfig	crypto: talitos - Fix build error by selecting LIB_DES	2019-12-04 22:31:07 +01:00
Makefile	crypto: atmel-i2c - add support for SHA204A random number generator	2019-05-30 15:35:45 +08:00
atmel-aes-regs.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
atmel-aes.c	crypto: atmel-aes - Fix IV handling when req->nbytes < ivsize	2019-12-13 08:43:05 +01:00
atmel-authenc.h	crypto: atmel - switch to SPDX license identifiers	2018-09-04 11:37:04 +08:00
atmel-ecc.c	crypto: atmel-ecc - factor out code that can be shared	2019-05-30 15:35:45 +08:00
atmel-i2c.c	crypto: atmel - Fix -Wunused-const-variable warning	2019-08-30 18:05:31 +10:00
atmel-i2c.h	crypto: atmel - Fix -Wunused-const-variable warning	2019-08-30 18:05:31 +10:00
atmel-sha-regs.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
atmel-sha.c	crypto: drivers - Remove dev_err() usage after platform_get_irq()	2019-08-09 15:11:38 +10:00
atmel-sha204a.c	crypto: atmel-sha204a - Use device-managed registration API	2019-08-02 14:43:59 +10:00
atmel-tdes-regs.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
atmel-tdes.c	crypto: atmel/des - switch to new verification routines	2019-08-22 14:39:38 +10:00
exynos-rng.c	crypto: exynos - use devm_platform_ioremap_resource() to simplify code	2019-08-09 15:11:59 +10:00
geode-aes.c	crypto: geode-aes - switch to skcipher for cbc(aes) fallback	2019-12-13 08:43:08 +01:00
geode-aes.h	crypto: geode-aes - switch to skcipher for cbc(aes) fallback	2019-12-13 08:43:08 +01:00
hifn_795x.c	crypto: hifn/des - switch to new verification routines	2019-08-22 14:39:40 +10:00
img-hash.c	crypto: img-hash - use devm_platform_ioremap_resource() to simplify code	2019-08-09 15:11:59 +10:00
ixp4xx_crypto.c	crypto: ixp4xx/des - switch to new verification routines	2019-08-22 14:57:31 +10:00
mxs-dcp.c	crypto: drivers - Remove dev_err() usage after platform_get_irq()	2019-08-09 15:11:38 +10:00
n2_asm.S	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
n2_core.c	crypto: n2 - Rename arrays to avoid conflict with crypto/sha256.h	2019-09-05 14:54:54 +10:00
n2_core.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
omap-aes-gcm.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
omap-aes.c	crypto: drivers - Remove dev_err() usage after platform_get_irq()	2019-08-09 15:11:38 +10:00
omap-aes.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
omap-crypto.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
omap-crypto.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
omap-des.c	crypto: omap/des - switch to new verification routines	2019-08-22 14:57:31 +10:00
omap-sham.c	crypto: drivers - Remove dev_err() usage after platform_get_irq()	2019-08-09 15:11:38 +10:00
padlock-aes.c	crypto: padlock/aes - switch to library version of key expansion routine	2019-07-26 14:56:02 +10:00
padlock-sha.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
picoxcell_crypto.c	crypto: picoxcell/des - switch to new verification routines	2019-08-22 14:57:31 +10:00
picoxcell_crypto_regs.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156	2019-05-30 11:26:35 -07:00
qcom-rng.c	crypto: qcom-rng - use devm_platform_ioremap_resource() to simplify code	2019-08-09 15:12:03 +10:00
s5p-sss.c	crypto: s5p - use correct block size of 1 for ctr(aes)	2019-08-30 18:05:28 +10:00
sahara.c	crypto: drivers - Remove dev_err() usage after platform_get_irq()	2019-08-09 15:11:38 +10:00
talitos.c	crypto: talitos - fix missing break in switch statement	2019-09-20 22:53:08 +10:00
talitos.h	crypto: talitos - drop icv_ool	2019-07-03 22:13:11 +08:00