kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers/crypto
History
Damian Muszynski 8a5a7611cc crypto: qat - resolve race condition during AER recovery 
[ Upstream commit 7d42e09760 ]

During the PCI AER system's error recovery process, the kernel driver
may encounter a race condition with freeing the reset_data structure's
memory. If the device restart will take more than 10 seconds the function
scheduling that restart will exit due to a timeout, and the reset_data
structure will be freed. However, this data structure is used for
completion notification after the restart is completed, which leads
to a UAF bug.

This results in a KFENCE bug notice.

  BUG: KFENCE: use-after-free read in adf_device_reset_worker+0x38/0xa0 [intel_qat]
  Use-after-free read at 0x00000000bc56fddf (in kfence-#142):
  adf_device_reset_worker+0x38/0xa0 [intel_qat]
  process_one_work+0x173/0x340

To resolve this race condition, the memory associated to the container
of the work_struct is freed on the worker if the timeout expired,
otherwise on the function that schedules the worker.
The timeout detection can be done by checking if the caller is
still waiting for completion or not by using completion_done() function.

Fixes: d8cba25d2c ("crypto: qat - Intel(R) QAT driver framework")
Cc: <stable@vger.kernel.org>
Signed-off-by: Damian Muszynski <damian.muszynski@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-04-03 15:28:19 +02:00
..
allwinner crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
amcc crypto: crypto4xx - remove unnecessary (void*) conversions 2023-03-24 18:22:28 +08:00
amlogic crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
aspeed crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
axis crypto: artpec6 - Use request_complete helpers 2023-02-13 18:34:49 +08:00
bcm crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
caam crypto: caam/jr - fix Chacha20 + Poly1305 self test failure 2023-11-20 11:59:19 +01:00
cavium crypto: cavium/nitrox - remove unnecessary aer.h include 2023-03-17 11:16:43 +08:00
ccp crypto: ccp - Avoid discarding errors in psp_send_platform_access_msg() 2024-03-26 18:19:51 -04:00
ccree crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
chelsio crypto: chelsio - Remove unused declarations 2023-08-25 18:46:55 +08:00
gemini crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
hisilicon crypto: hisilicon/zip - save capability registers in probe process 2024-01-25 15:35:17 -08:00
inside-secure crypto: safexcel - Add error handling for dma_map_sg() calls 2024-01-25 15:35:16 -08:00
intel crypto: qat - resolve race condition during AER recovery 2024-04-03 15:28:19 +02:00
marvell crypto: octeontx2 - Fix cptvf driver cleanup 2024-02-05 20:14:16 +00:00
nx crypto: nx - fix build warnings when DEBUG_FS is not enabled 2023-05-24 18:12:33 +08:00
qce crypto: qce - Add a QCE IP family compatible 'qcom,qce' 2023-03-14 17:06:44 +08:00
rockchip crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
starfive crypto: starfive - Fix dev_err_probe return error 2024-02-05 20:14:16 +00:00
stm32 crypto: stm32/crc32 - fix parsing list of devices 2024-02-05 20:14:16 +00:00
virtio crypto: virtio/akcipher - Fix stack overflow on memcpy 2024-03-01 13:35:01 +01:00
vmx Merge branch 'topic/objtool' into next 2022-12-08 23:57:47 +11:00
xilinx crypto: xilinx - call finalize with bh disabled 2024-03-26 18:19:46 -04:00
atmel-aes-regs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
atmel-aes.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
atmel-authenc.h crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
atmel-ecc.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
atmel-i2c.c This update includes the following changes: 2023-02-21 18:10:50 -08:00
atmel-i2c.h This update includes the following changes: 2023-02-21 18:10:50 -08:00
atmel-sha-regs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
atmel-sha.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
atmel-sha204a.c crypto: atmel - Switch i2c drivers back to use .probe() 2023-06-02 18:21:32 +08:00
atmel-tdes-regs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
atmel-tdes.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
exynos-rng.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
geode-aes.c crypto: geode - use DEFINE_SPINLOCK() for spinlock 2021-04-16 21:16:31 +10:00
geode-aes.h crypto: geode-aes - convert to skcipher API and make thread-safe 2019-10-23 19:46:56 +11:00
hifn_795x.c crypto: drivers - remove unnecessary (void*) conversions 2023-03-24 18:22:28 +08:00
img-hash.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
Kconfig s390/zcrypt: remove CEX2 and CEX3 device drivers 2023-07-24 12:12:22 +02:00
Makefile crypto: starfive - Add crypto engine support 2023-05-19 16:46:22 +08:00
mxs-dcp.c crypto: mxs-dcp - Use the devm_clk_get_optional_enabled() helper 2023-03-31 17:50:09 +08:00
n2_asm.S License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
n2_core.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
n2_core.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
omap-aes-gcm.c crypto: omap - Use new crypto_engine_op interface 2023-08-18 17:01:11 +08:00
omap-aes.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
omap-aes.h crypto: omap - Use new crypto_engine_op interface 2023-08-18 17:01:11 +08:00
omap-crypto.c crypto: omap - Avoid redundant copy when using truncated sg list 2021-08-21 15:44:53 +08:00
omap-crypto.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
omap-des.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
omap-sham.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
padlock-aes.c crypto: algapi - Remove skbuff.h inclusion 2020-08-20 14:04:28 +10:00
padlock-sha.c crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
qcom-rng.c crypto: qcom-rng: Make the core clock optional regardless of ACPI presence 2023-08-18 17:01:09 +08:00
s5p-sss.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
sa2ul.c crypto: sa2ul - Return crypto_aead_setkey to transfer the error 2024-01-25 15:35:16 -08:00
sa2ul.h crypto: sa2ul - change unsafe data size limit to 255 bytes 2023-05-19 16:45:43 +08:00
sahara.c crypto: sahara - do not resize req->src when doing hash operations 2024-01-25 15:35:18 -08:00
talitos.c crypto: drivers - Explicitly include correct DT includes 2023-08-23 11:04:23 +08:00
talitos.h crypto: talitos - Replace zero-length arrays with DECLARE_FLEX_ARRAY() helper 2022-10-21 19:05:24 +08:00