From patchwork Fri Feb 28 10:00:20 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Sridhar, Kanchana P" X-Patchwork-Id: 13996119 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4862C19776 for ; Fri, 28 Feb 2025 10:01:13 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id EA0F6280010; Fri, 28 Feb 2025 05:00:42 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E51EA28000F; Fri, 28 Feb 2025 05:00:42 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CA426280010; Fri, 28 Feb 2025 05:00:42 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 9C86828000F for ; Fri, 28 Feb 2025 05:00:42 -0500 (EST) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 2421A1A0706 for ; Fri, 28 Feb 2025 10:00:42 +0000 (UTC) X-FDA: 83168909124.30.4070060 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.18]) by imf27.hostedemail.com (Postfix) with ESMTP id 1B6F84000A for ; Fri, 28 Feb 2025 10:00:37 +0000 (UTC) Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=CJdeID3i; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf27.hostedemail.com: domain of kanchana.p.sridhar@intel.com designates 192.198.163.18 as permitted sender) smtp.mailfrom=kanchana.p.sridhar@intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1740736838; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=+eOTM3Nk/Zac48FupoTlTwnc9jTXgoQyfvQyY2539qA=; b=13WEeDZJyQ1ihWDCblf8L0lyOQ2qrCpD7JOYELdWuIz07HCIcLuw2BDT9sP/y5OBBShdMu 2S6RtTDK6NEHmi7VSeuV8WvteuD5OKP2rDBJvJo3JVR7JhwoQIgajius9OcdgMbq4/0Urb 7Ubtyuy6WGvQ2EaC0sfgR+rXtJxLmR4= ARC-Authentication-Results: i=1; imf27.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=CJdeID3i; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf27.hostedemail.com: domain of kanchana.p.sridhar@intel.com designates 192.198.163.18 as permitted sender) smtp.mailfrom=kanchana.p.sridhar@intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1740736838; a=rsa-sha256; cv=none; b=YFYQa68hK0SF0zmSvnluouSICQVrTsa00FKOwtirhoOQSE13sN0yqdv1RGFkdt81UqfzpG X7u26GzMawDeHQGsxPQfDc4u+yrlikxxYpdq3MGLjm7CYshCKSWYU8ckQHMxruUoo7f0xX U7VPY6lt/LF7e/kyECZCFF9GnrKBEds= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1740736838; x=1772272838; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=nu1yNk8S8EgSrO+ZHhQ4Hl0iMXbUsnYxF38CaLmoAAI=; b=CJdeID3ih8i6tfyoBKtaqC8K+bFs0amxUj7mfkblKLCXgCN1/3rP4Byx Pxqoc+GNcr0VOOE0/dwr6mihXG5rKq1I9S0i8er/oMOKV8rCZGSS+Wqj9 P1zaLyFfXLlFKKbfUYiYqAmGg3ArJt5v6za5ZCzYbRM/mbj++KYatVtPB +oJlTUNKWI/ntzyW0SAGREtPigEzH6XJSHvA9K47N9f4XQcTkhPWqamYj OD+ERUAb57sx+C+zGxJ4fpwAFV1rqs+eq18XXDs7ZY84B4E3Xjqm97FLf qFYM2J3UP2ORZVWT581S4gQRwc2lgU3/FFXykZs+cHijlpomsByqHwz6I w==; X-CSE-ConnectionGUID: aYVUzVKRQLCn/5ea2EPI8g== X-CSE-MsgGUID: 3FrxyS7DTEK76p0INZs8Zw== X-IronPort-AV: E=McAfee;i="6700,10204,11358"; a="40902696" X-IronPort-AV: E=Sophos;i="6.13,322,1732608000"; d="scan'208";a="40902696" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by fmvoesa112.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Feb 2025 02:00:28 -0800 X-CSE-ConnectionGUID: oQnOQUszQLSG6ECXKMtNow== X-CSE-MsgGUID: yhZ+k6hdQkGkDfWwMFVwbA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.13,322,1732608000"; d="scan'208";a="117325741" Received: from jf5300-b11a338t.jf.intel.com ([10.242.51.115]) by orviesa006.jf.intel.com with ESMTP; 28 Feb 2025 02:00:28 -0800 From: Kanchana P Sridhar To: linux-kernel@vger.kernel.org, linux-mm@kvack.org, hannes@cmpxchg.org, yosry.ahmed@linux.dev, nphamcs@gmail.com, chengming.zhou@linux.dev, usamaarif642@gmail.com, ryan.roberts@arm.com, 21cnbao@gmail.com, ying.huang@linux.alibaba.com, akpm@linux-foundation.org, linux-crypto@vger.kernel.org, herbert@gondor.apana.org.au, davem@davemloft.net, clabbe@baylibre.com, ardb@kernel.org, ebiggers@google.com, surenb@google.com, kristen.c.accardi@intel.com Cc: wajdi.k.feghali@intel.com, vinodh.gopal@intel.com, kanchana.p.sridhar@intel.com Subject: [PATCH v7 11/15] crypto: iaa - Fix for "deflate_generic_tfm" global being accessed without locks. Date: Fri, 28 Feb 2025 02:00:20 -0800 Message-Id: <20250228100024.332528-12-kanchana.p.sridhar@intel.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20250228100024.332528-1-kanchana.p.sridhar@intel.com> References: <20250228100024.332528-1-kanchana.p.sridhar@intel.com> MIME-Version: 1.0 X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 1B6F84000A X-Rspam-User: X-Stat-Signature: e1g146gzzeo1kk96tyuq4ug6mieh1xoa X-HE-Tag: 1740736837-633042 X-HE-Meta: U2FsdGVkX1/ncbtBLTXBUeFYz4I6jYvvuC9mDwolWaCZlsJO1Qx8NfZKpECkIsGY9a+HcImkAJVnuU5lGs7Ss/+2XsL55TecJf4K4iJF6ASJGOcCQBfZeT9msOK1wLdGaDUPDM6KVV0Wk8A2Jz1qhwR93fFaUgaV5+dSdI2b4A0OOOqoEBtCuVqDReP2xgYg5KNXS2AV6Vom4Bb1Y/aW8TcaYuJ66YfDR+bCguy+0fL8+OJ0OmB/BzcRadA84C6tkEGEmF6x4rYNSXB5BNx8s0h67mlXDBGQuqFB/GE2M5RxIwtDuPI+J4m1/vP8L5KiH2FiE38HSaJcbVOFpifUChGmAkSbDsJ5ongJJGO4Py6KRZxbgzickJtOix4ppa4NklqP+KNL6ehAPxG+vsea3aoh0pTp2vqBxCjwfOVLdmaSxYx20M4P/n6d70ZAXM03TDaTP58TR/QCzPiy74dyNlNeNVoFha5KPMi018Q42sNyDOYtuJguBFIDsvd/6bbnEVgrBHWPKuUhpzC1QBkX/xLWxmOeq5Ymn/7h5VwTbcP1Ue+gxunEz22F7O8jZnHoOaeAM1TmZqN9a3l5azRvQO5DLpm3NWLsCdxxyMrXcRkLQQIC66rOFB5f6gU0VmX4qmnulF3uRDXeVxo3F36RbjlZ1N5OgBUWu+fYXiD1Ljv1xnaLboow4Ds2OB4jdHTOb4h9nfsj6o8GH+orR4QWYB3bzTIdJ/9qgDQY/exRTYE7Ekg3GYjY4Df57RjU9oHIYP8aMoZhhzT7xRIAY8U7xADT5H17khOacFd7cbESV9wVZWkDfJ7+WdrO4Rw/lT6B1FShLOwoTAiQRNULs65ngI8y01LRhqVvppnsatj0tDne5c9F0p/JSsIvjcKdrH+M5TLRb0+j519dJ9gRj2zgD7fzSU6YCasn5gC0g2JrApI4MUJqv5VKvTMeCDNxnjZWadKWvMntT+alAH6gOaO RmdIjVqN WWLfVEvDfIaaKINLYwig7e7wFbKhGJQG7dZWM10vlPGp7/0ROFutLKn5V01GW6tbKZy16U6qWfaKO1PeyO1camNosvo3BgAuddKWNFe86DNMfIWWy8JOfnGwLauhmUHBUp06FIJu9ynMOwi9gyNubBEXiaVIp5gTWKlBeairb4yH3EXbB2y/KsKLisReqQZCK4K8iRiTtuVLCqMBcQL41ERHcvzjNknWUXMtlBbvzEByPsUY= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: The mainline implementation of "deflate_generic_decompress" has a bug in the usage of this global variable: static struct crypto_comp *deflate_generic_tfm; The "deflate_generic_tfm" is allocated at module init time, and freed during module cleanup. Any calls to software decompress, for instance, if descriptor allocation fails or job submission fails, will trigger this bug in the deflate_generic_decompress() procedure. The problem is the unprotected access of "deflate_generic_tfm" in this procedure. While stress testing workloads under high memory pressure, with 1 IAA device and "deflate-iaa" as the compressor, the descriptor allocation times out and the software fallback route is taken. With multiple processes calling: ret = crypto_comp_decompress(deflate_generic_tfm, src, req->slen, dst, &req->dlen); we end up with data corruption, that results in req->dlen being larger than PAGE_SIZE. zswap_decompress() subsequently raises a kernel bug. This bug can manifest under high contention and memory pressure situations with high likelihood. This has been resolved by adding a mutex, which is locked before accessing "deflate_generic_tfm" and unlocked after the crypto_comp call is done. Signed-off-by: Kanchana P Sridhar --- drivers/crypto/intel/iaa/iaa_crypto_main.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/crypto/intel/iaa/iaa_crypto_main.c b/drivers/crypto/intel/iaa/iaa_crypto_main.c index 7503fafca279..2a994f307679 100644 --- a/drivers/crypto/intel/iaa/iaa_crypto_main.c +++ b/drivers/crypto/intel/iaa/iaa_crypto_main.c @@ -105,6 +105,7 @@ static struct iaa_compression_mode *iaa_compression_modes[IAA_COMP_MODES_MAX]; LIST_HEAD(iaa_devices); DEFINE_MUTEX(iaa_devices_lock); +DEFINE_MUTEX(deflate_generic_tfm_lock); /* If enabled, IAA hw crypto algos are registered, unavailable otherwise */ static bool iaa_crypto_enabled; @@ -1407,6 +1408,9 @@ static int deflate_generic_decompress(struct acomp_req *req) int ret; req->dlen = PAGE_SIZE; + + mutex_lock(&deflate_generic_tfm_lock); + src = kmap_local_page(sg_page(req->src)) + req->src->offset; dst = kmap_local_page(sg_page(req->dst)) + req->dst->offset; @@ -1416,6 +1420,8 @@ static int deflate_generic_decompress(struct acomp_req *req) kunmap_local(src); kunmap_local(dst); + mutex_unlock(&deflate_generic_tfm_lock); + update_total_sw_decomp_calls(); return ret;