93175d935d
commit 3c2214b6027ff37945799de717c417212e1a8c54 upstream.
Removing the pcrypt module triggers this:
general protection fault, probably for non-canonical
address 0xdead000000000122
CPU: 5 PID: 264 Comm: modprobe Not tainted 5.6.0+ #2
Hardware name: QEMU Standard PC
RIP: 0010:__cpuhp_state_remove_instance+0xcc/0x120
Call Trace:
padata_sysfs_release+0x74/0xce
kobject_put+0x81/0xd0
padata_free+0x12/0x20
pcrypt_exit+0x43/0x8ee [pcrypt]
padata instances wrongly use the same hlist node for the online and dead
states, so __padata_free()'s second cpuhp remove call chokes on the node
that the first poisoned.
cpuhp multi-instance callbacks only walk forward in cpuhp_step->list and
the same node is linked in both the online and dead lists, so the list
corruption that results from padata_alloc() adding the node to a second
list without removing it from the first doesn't cause problems as long
as no instances are freed.
Avoid the issue by giving each state its own node.
Fixes: 894c9ef9780c ("padata: validate cpumask without removed CPU during offline")
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: linux-crypto@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org # v5.4+
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
183 lines
5.9 KiB
C
183 lines
5.9 KiB
C
/*
|
|
* padata.h - header for the padata parallelization interface
|
|
*
|
|
* Copyright (C) 2008, 2009 secunet Security Networks AG
|
|
* Copyright (C) 2008, 2009 Steffen Klassert <steffen.klassert@secunet.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms and conditions of the GNU General Public License,
|
|
* version 2, as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
|
|
* more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along with
|
|
* this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*/
|
|
|
|
#ifndef PADATA_H
|
|
#define PADATA_H
|
|
|
|
#include <linux/workqueue.h>
|
|
#include <linux/spinlock.h>
|
|
#include <linux/list.h>
|
|
#include <linux/notifier.h>
|
|
#include <linux/kobject.h>
|
|
|
|
#define PADATA_CPU_SERIAL 0x01
|
|
#define PADATA_CPU_PARALLEL 0x02
|
|
|
|
/**
|
|
* struct padata_priv - Embedded to the users data structure.
|
|
*
|
|
* @list: List entry, to attach to the padata lists.
|
|
* @pd: Pointer to the internal control structure.
|
|
* @cb_cpu: Callback cpu for serializatioon.
|
|
* @cpu: Cpu for parallelization.
|
|
* @seq_nr: Sequence number of the parallelized data object.
|
|
* @info: Used to pass information from the parallel to the serial function.
|
|
* @parallel: Parallel execution function.
|
|
* @serial: Serial complete function.
|
|
*/
|
|
struct padata_priv {
|
|
struct list_head list;
|
|
struct parallel_data *pd;
|
|
int cb_cpu;
|
|
int cpu;
|
|
int info;
|
|
void (*parallel)(struct padata_priv *padata);
|
|
void (*serial)(struct padata_priv *padata);
|
|
};
|
|
|
|
/**
|
|
* struct padata_list
|
|
*
|
|
* @list: List head.
|
|
* @lock: List lock.
|
|
*/
|
|
struct padata_list {
|
|
struct list_head list;
|
|
spinlock_t lock;
|
|
};
|
|
|
|
/**
|
|
* struct padata_serial_queue - The percpu padata serial queue
|
|
*
|
|
* @serial: List to wait for serialization after reordering.
|
|
* @work: work struct for serialization.
|
|
* @pd: Backpointer to the internal control structure.
|
|
*/
|
|
struct padata_serial_queue {
|
|
struct padata_list serial;
|
|
struct work_struct work;
|
|
struct parallel_data *pd;
|
|
};
|
|
|
|
/**
|
|
* struct padata_parallel_queue - The percpu padata parallel queue
|
|
*
|
|
* @parallel: List to wait for parallelization.
|
|
* @reorder: List to wait for reordering after parallel processing.
|
|
* @serial: List to wait for serialization after reordering.
|
|
* @pwork: work struct for parallelization.
|
|
* @swork: work struct for serialization.
|
|
* @work: work struct for parallelization.
|
|
* @num_obj: Number of objects that are processed by this cpu.
|
|
* @cpu_index: Index of the cpu.
|
|
*/
|
|
struct padata_parallel_queue {
|
|
struct padata_list parallel;
|
|
struct padata_list reorder;
|
|
struct work_struct work;
|
|
atomic_t num_obj;
|
|
int cpu_index;
|
|
};
|
|
|
|
/**
|
|
* struct padata_cpumask - The cpumasks for the parallel/serial workers
|
|
*
|
|
* @pcpu: cpumask for the parallel workers.
|
|
* @cbcpu: cpumask for the serial (callback) workers.
|
|
*/
|
|
struct padata_cpumask {
|
|
cpumask_var_t pcpu;
|
|
cpumask_var_t cbcpu;
|
|
};
|
|
|
|
/**
|
|
* struct parallel_data - Internal control structure, covers everything
|
|
* that depends on the cpumask in use.
|
|
*
|
|
* @pinst: padata instance.
|
|
* @pqueue: percpu padata queues used for parallelization.
|
|
* @squeue: percpu padata queues used for serialuzation.
|
|
* @reorder_objects: Number of objects waiting in the reorder queues.
|
|
* @refcnt: Number of objects holding a reference on this parallel_data.
|
|
* @max_seq_nr: Maximal used sequence number.
|
|
* @cpu: Next CPU to be processed.
|
|
* @cpumask: The cpumasks in use for parallel and serial workers.
|
|
* @reorder_work: work struct for reordering.
|
|
* @lock: Reorder lock.
|
|
*/
|
|
struct parallel_data {
|
|
struct padata_instance *pinst;
|
|
struct padata_parallel_queue __percpu *pqueue;
|
|
struct padata_serial_queue __percpu *squeue;
|
|
atomic_t reorder_objects;
|
|
atomic_t refcnt;
|
|
atomic_t seq_nr;
|
|
int cpu;
|
|
struct padata_cpumask cpumask;
|
|
struct work_struct reorder_work;
|
|
spinlock_t lock ____cacheline_aligned;
|
|
};
|
|
|
|
/**
|
|
* struct padata_instance - The overall control structure.
|
|
*
|
|
* @cpu_online_node: Linkage for CPU online callback.
|
|
* @cpu_dead_node: Linkage for CPU offline callback.
|
|
* @wq: The workqueue in use.
|
|
* @pd: The internal control structure.
|
|
* @cpumask: User supplied cpumasks for parallel and serial works.
|
|
* @cpumask_change_notifier: Notifiers chain for user-defined notify
|
|
* callbacks that will be called when either @pcpu or @cbcpu
|
|
* or both cpumasks change.
|
|
* @kobj: padata instance kernel object.
|
|
* @lock: padata instance lock.
|
|
* @flags: padata flags.
|
|
*/
|
|
struct padata_instance {
|
|
struct hlist_node cpu_online_node;
|
|
struct hlist_node cpu_dead_node;
|
|
struct workqueue_struct *wq;
|
|
struct parallel_data *pd;
|
|
struct padata_cpumask cpumask;
|
|
struct blocking_notifier_head cpumask_change_notifier;
|
|
struct kobject kobj;
|
|
struct mutex lock;
|
|
u8 flags;
|
|
#define PADATA_INIT 1
|
|
#define PADATA_RESET 2
|
|
#define PADATA_INVALID 4
|
|
};
|
|
|
|
extern struct padata_instance *padata_alloc_possible(
|
|
struct workqueue_struct *wq);
|
|
extern void padata_free(struct padata_instance *pinst);
|
|
extern int padata_do_parallel(struct padata_instance *pinst,
|
|
struct padata_priv *padata, int cb_cpu);
|
|
extern void padata_do_serial(struct padata_priv *padata);
|
|
extern int padata_set_cpumask(struct padata_instance *pinst, int cpumask_type,
|
|
cpumask_var_t cpumask);
|
|
extern int padata_start(struct padata_instance *pinst);
|
|
extern void padata_stop(struct padata_instance *pinst);
|
|
extern int padata_register_cpumask_notifier(struct padata_instance *pinst,
|
|
struct notifier_block *nblock);
|
|
extern int padata_unregister_cpumask_notifier(struct padata_instance *pinst,
|
|
struct notifier_block *nblock);
|
|
#endif
|