From patchwork Mon Mar 3 08:47:21 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Sridhar, Kanchana P" X-Patchwork-Id: 13998355 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 254F4C282C5 for ; Mon, 3 Mar 2025 08:48:05 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 87A5128001E; Mon, 3 Mar 2025 03:47:45 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 8030F28001D; Mon, 3 Mar 2025 03:47:45 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5B33728001C; Mon, 3 Mar 2025 03:47:45 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 3C2D828000B for ; Mon, 3 Mar 2025 03:47:45 -0500 (EST) Received: from smtpin17.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id EF0E61404B4 for ; Mon, 3 Mar 2025 08:47:44 +0000 (UTC) X-FDA: 83179611648.17.CC0380E Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.14]) by imf24.hostedemail.com (Postfix) with ESMTP id CFC6418000F for ; Mon, 3 Mar 2025 08:47:42 +0000 (UTC) Authentication-Results: imf24.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=NsjIL2CN; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf24.hostedemail.com: domain of kanchana.p.sridhar@intel.com designates 192.198.163.14 as permitted sender) smtp.mailfrom=kanchana.p.sridhar@intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1740991663; a=rsa-sha256; cv=none; b=wSaK2UysIrE/KrSxX567n+WV9/uRcqY9zlUWmBc4Q9k7tzQ5OkVgcdbaOFzlu+Tn4qNa+9 l14QYFxT8MDeyoXztDRQgnewdtuqU4PfIaJoF6WkZHLvURWLfBTTqcrgJvFVSFB2xK8JVM tzKipQTKl/S90fcbqmRj/SMUTWxI0Jk= ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=NsjIL2CN; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf24.hostedemail.com: domain of kanchana.p.sridhar@intel.com designates 192.198.163.14 as permitted sender) smtp.mailfrom=kanchana.p.sridhar@intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1740991663; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=+eOTM3Nk/Zac48FupoTlTwnc9jTXgoQyfvQyY2539qA=; b=vgX0qu5WAYih/Z57b0zbF0fW0hGkPkOsvQ6LN8vtFJ3Q1Ako9zNxLtmb2kauy/bx3i8Ioq tqfEIvndYCpAjJB+2w64khfqMSaEgazgEvJyPK1mpafc91fNCnlTaVFedwfuxuX4VLpMDP A5d2qD/HbVGESSXiiJSnSVNWI/0rdu8= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1740991663; x=1772527663; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=nu1yNk8S8EgSrO+ZHhQ4Hl0iMXbUsnYxF38CaLmoAAI=; b=NsjIL2CNvS6jIZSg4V2txfYUfFDgVOdxZiL15utmPeWdzE++YtUuOzyy r01D9IqJLQEAVFYl3xFk0+0eCR7S2HJ/mwrbuzLLAighxl06QCUcElxN8 MjaOjKroPzxotOY6k/3DlLu4rdiDFJQsfA72OUb0MrXND/geTvMaM9OEK elIxDM9MISful6vq4hKxk6ez4F9n9i02lS8OChEg3fVPS2ecJd6irqcmr szwaVdzVRXktXpZhWhNXi37nPsRYTR1XqnMR/Ti6zQMonc16lpQCtJzx/ +n+dphpfuHsTKE/jxQBoiSOBghwSLeDaOc5er3pdQHU5NYbaX6mIrLUOM g==; X-CSE-ConnectionGUID: DJgl1wFfQ7SruGNRNuaOHw== X-CSE-MsgGUID: yeLdyS/gTlmpw4UZY7ebrg== X-IronPort-AV: E=McAfee;i="6700,10204,11361"; a="42111995" X-IronPort-AV: E=Sophos;i="6.13,329,1732608000"; d="scan'208";a="42111995" Received: from fmviesa010.fm.intel.com ([10.60.135.150]) by fmvoesa108.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Mar 2025 00:47:39 -0800 X-CSE-ConnectionGUID: RcBRVQJHThmfzPKoFFz43Q== X-CSE-MsgGUID: Mf9Syfb0RG6aEdF/ZVQZAQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.13,329,1732608000"; d="scan'208";a="118426822" Received: from jf5300-b11a338t.jf.intel.com ([10.242.51.115]) by fmviesa010.fm.intel.com with ESMTP; 03 Mar 2025 00:47:36 -0800 From: Kanchana P Sridhar To: linux-kernel@vger.kernel.org, linux-mm@kvack.org, hannes@cmpxchg.org, yosry.ahmed@linux.dev, nphamcs@gmail.com, chengming.zhou@linux.dev, usamaarif642@gmail.com, ryan.roberts@arm.com, 21cnbao@gmail.com, ying.huang@linux.alibaba.com, akpm@linux-foundation.org, linux-crypto@vger.kernel.org, herbert@gondor.apana.org.au, davem@davemloft.net, clabbe@baylibre.com, ardb@kernel.org, ebiggers@google.com, surenb@google.com, kristen.c.accardi@intel.com Cc: wajdi.k.feghali@intel.com, vinodh.gopal@intel.com, kanchana.p.sridhar@intel.com Subject: [PATCH v8 11/14] crypto: iaa - Fix for "deflate_generic_tfm" global being accessed without locks. Date: Mon, 3 Mar 2025 00:47:21 -0800 Message-Id: <20250303084724.6490-12-kanchana.p.sridhar@intel.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20250303084724.6490-1-kanchana.p.sridhar@intel.com> References: <20250303084724.6490-1-kanchana.p.sridhar@intel.com> MIME-Version: 1.0 X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: CFC6418000F X-Stat-Signature: grqc1kgrggk5pfnmm136x39kt6sjqhgs X-Rspam-User: X-HE-Tag: 1740991662-653550 X-HE-Meta: U2FsdGVkX1+skyad8KQQbhAp8Y2Ov8AcQ5VnO4cfkVerP4Wpwj1n+nLuo5NY1aVHuxM4AOd7Th8TE5X5xHhZGQDwZfy63LILVPbgY8WfgMNZox/Edh/SDUjQ0Pwxo1ySp2lRF09aypg0vd/3ugdVFFVF0glKmU3UFICyk3DR1G0ElmcHYYFHOszrn2/AyzW30vmMF0zPaBZ+Q7zM4MeN1mYiSvXVClK7NO3EHE/qEDCRZqjyp0IduMhx6ZnViCXUEX6NrLBiRNB1AQPjIftnOouEQKyy1VtUH8DXHamH6oLXbW8OTp1kvQuOxoCOqyyWFuKkQk+J7eXA6fFWDeaoV2D1ZtzGURAFoB7W6ZouSgr0jO+PUoakf/RN83ueO9kmgAuiO1N+C/jRlqRZSV1Iy2OHC8zMmAqktdeNy4hUr0aX4wdmbFrjtFfYlnXsUZKkNzKENIjC3PKIVrbnqRRQu/u4v1KFVJO+RToAxFXeVy1+Cl8raZ8RrYqqnC7DCSKS97fulZ7vj8j34Usgbz1hTuifvmxzIsqGtys1GoNLa+mHNJYtJf6lK9G2vXFgz1sPvOVygKxdRIF8q7k6AT1JTEujO2q557HCN5NvX+N77gjsAxJIiZGA2b/1KFmbzZsmr+Ph5KKbDrPjG0ccur+ECJNAqBIGDjh7zPT4GAeOYuaSZCxNNmXzFwD29UHpVQXxoYEBprP5ygu/YjXlAUKhsHgm8VxFlX4bfl5VgMcEL9raLqk6EwTRli1ElZpQZUSDgem9V54+LmiLOPooBAcm6N3BF2AoPRonO7uZWi1QMM/oT7u0sLyC71jGWYFqHM2BbshBpzPIo5JClcBQl/G2baUiqanWLvCaxWiSTD2qF361Xmp1sxy8qEvtdhXxlBL1pAENv9YFux1jnshjIhQzdTcr8m9XqT6PYDq4pg7Jb1+GLyqYKBATxlUQA3MkmaDByQq5Vj6XyKpXMhy5roG /Qdy9NE/ yzRZ+m5FLkSDQKFXejAMZg7ntwB+Czdbi9F+LJe+EJExKXciBWxvVE65DGOKHFR67pCXNinT/hfjmE+YLnfk03g6qcOkVGqFdhtKHG3hrUVeTELukq+b4iPTmwuYnGB8E22uc5nbLXDVVBIs2j8F75B+Y4yYds8Ee2nPUDI0dfRzcTJMI0ajcjvhFD+B5itrN4z51Uya63EHCEtfIzsz6RDxAcHrSFu7L5KnppU9ffhzpbrI= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: The mainline implementation of "deflate_generic_decompress" has a bug in the usage of this global variable: static struct crypto_comp *deflate_generic_tfm; The "deflate_generic_tfm" is allocated at module init time, and freed during module cleanup. Any calls to software decompress, for instance, if descriptor allocation fails or job submission fails, will trigger this bug in the deflate_generic_decompress() procedure. The problem is the unprotected access of "deflate_generic_tfm" in this procedure. While stress testing workloads under high memory pressure, with 1 IAA device and "deflate-iaa" as the compressor, the descriptor allocation times out and the software fallback route is taken. With multiple processes calling: ret = crypto_comp_decompress(deflate_generic_tfm, src, req->slen, dst, &req->dlen); we end up with data corruption, that results in req->dlen being larger than PAGE_SIZE. zswap_decompress() subsequently raises a kernel bug. This bug can manifest under high contention and memory pressure situations with high likelihood. This has been resolved by adding a mutex, which is locked before accessing "deflate_generic_tfm" and unlocked after the crypto_comp call is done. Signed-off-by: Kanchana P Sridhar --- drivers/crypto/intel/iaa/iaa_crypto_main.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/crypto/intel/iaa/iaa_crypto_main.c b/drivers/crypto/intel/iaa/iaa_crypto_main.c index 7503fafca279..2a994f307679 100644 --- a/drivers/crypto/intel/iaa/iaa_crypto_main.c +++ b/drivers/crypto/intel/iaa/iaa_crypto_main.c @@ -105,6 +105,7 @@ static struct iaa_compression_mode *iaa_compression_modes[IAA_COMP_MODES_MAX]; LIST_HEAD(iaa_devices); DEFINE_MUTEX(iaa_devices_lock); +DEFINE_MUTEX(deflate_generic_tfm_lock); /* If enabled, IAA hw crypto algos are registered, unavailable otherwise */ static bool iaa_crypto_enabled; @@ -1407,6 +1408,9 @@ static int deflate_generic_decompress(struct acomp_req *req) int ret; req->dlen = PAGE_SIZE; + + mutex_lock(&deflate_generic_tfm_lock); + src = kmap_local_page(sg_page(req->src)) + req->src->offset; dst = kmap_local_page(sg_page(req->dst)) + req->dst->offset; @@ -1416,6 +1420,8 @@ static int deflate_generic_decompress(struct acomp_req *req) kunmap_local(src); kunmap_local(dst); + mutex_unlock(&deflate_generic_tfm_lock); + update_total_sw_decomp_calls(); return ret;