releases/4.19.31/crypto-caam-fix-dma-mapping-of-stack-memory.patch

   1 From c19650d6ea99bcd903d3e55dd61860026c701339 Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Horia=20Geant=C4=83?= <horia.geanta@nxp.com>
   3 Date: Sat, 26 Jan 2019 20:02:15 +0200
   4 Subject: crypto: caam - fix DMA mapping of stack memory
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 From: Horia Geantă <horia.geanta@nxp.com>
  10
  11 commit c19650d6ea99bcd903d3e55dd61860026c701339 upstream.
  12
  13 Roland reports the following issue and provides a root cause analysis:
  14
  15 "On a v4.19 i.MX6 system with IMA and CONFIG_DMA_API_DEBUG enabled, a
  16 warning is generated when accessing files on a filesystem for which IMA
  17 measurement is enabled:
  18
  19     ------------[ cut here ]------------
  20     WARNING: CPU: 0 PID: 1 at kernel/dma/debug.c:1181 check_for_stack.part.9+0xd0/0x120
  21     caam_jr 2101000.jr0: DMA-API: device driver maps memory from stack [addr=b668049e]
  22     Modules linked in:
  23     CPU: 0 PID: 1 Comm: switch_root Not tainted 4.19.0-20181214-1 #2
  24     Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
  25     Backtrace:
  26     [<c010efb8>] (dump_backtrace) from [<c010f2d0>] (show_stack+0x20/0x24)
  27     [<c010f2b0>] (show_stack) from [<c08b04f4>] (dump_stack+0xa0/0xcc)
  28     [<c08b0454>] (dump_stack) from [<c012b610>] (__warn+0xf0/0x108)
  29     [<c012b520>] (__warn) from [<c012b680>] (warn_slowpath_fmt+0x58/0x74)
  30     [<c012b62c>] (warn_slowpath_fmt) from [<c0199acc>] (check_for_stack.part.9+0xd0/0x120)
  31     [<c01999fc>] (check_for_stack.part.9) from [<c019a040>] (debug_dma_map_page+0x144/0x174)
  32     [<c0199efc>] (debug_dma_map_page) from [<c065f7f4>] (ahash_final_ctx+0x5b4/0xcf0)
  33     [<c065f240>] (ahash_final_ctx) from [<c065b3c4>] (ahash_final+0x1c/0x20)
  34     [<c065b3a8>] (ahash_final) from [<c03fe278>] (crypto_ahash_op+0x38/0x80)
  35     [<c03fe240>] (crypto_ahash_op) from [<c03fe2e0>] (crypto_ahash_final+0x20/0x24)
  36     [<c03fe2c0>] (crypto_ahash_final) from [<c03f19a8>] (ima_calc_file_hash+0x29c/0xa40)
  37     [<c03f170c>] (ima_calc_file_hash) from [<c03f2b24>] (ima_collect_measurement+0x1dc/0x240)
  38     [<c03f2948>] (ima_collect_measurement) from [<c03f0a60>] (process_measurement+0x4c4/0x6b8)
  39     [<c03f059c>] (process_measurement) from [<c03f0cdc>] (ima_file_check+0x88/0xa4)
  40     [<c03f0c54>] (ima_file_check) from [<c02d8adc>] (path_openat+0x5d8/0x1364)
  41     [<c02d8504>] (path_openat) from [<c02dad24>] (do_filp_open+0x84/0xf0)
  42     [<c02daca0>] (do_filp_open) from [<c02cf50c>] (do_open_execat+0x84/0x1b0)
  43     [<c02cf488>] (do_open_execat) from [<c02d1058>] (__do_execve_file+0x43c/0x890)
  44     [<c02d0c1c>] (__do_execve_file) from [<c02d1770>] (sys_execve+0x44/0x4c)
  45     [<c02d172c>] (sys_execve) from [<c0101000>] (ret_fast_syscall+0x0/0x28)
  46     ---[ end trace 3455789a10e3aefd ]---
  47
  48 The cause is that the struct ahash_request *req is created as a
  49 stack-local variable up in the stack (presumably somewhere in the IMA
  50 implementation), then passed down into the CAAM driver, which tries to
  51 dma_single_map the req->result (indirectly via map_seq_out_ptr_result)
  52 in order to make that buffer available for the CAAM to store the result
  53 of the following hash operation.
  54
  55 The calling code doesn't know how req will be used by the CAAM driver,
  56 and there could be other such occurrences where stack memory is passed
  57 down to the CAAM driver. Therefore we should rather fix this issue in
  58 the CAAM driver where the requirements are known."
  59
  60 Fix this problem by:
  61 -instructing the crypto engine to write the final hash in state->caam_ctx
  62 -subsequently memcpy-ing the final hash into req->result
  63
  64 Cc: <stable@vger.kernel.org> # v4.19+
  65 Reported-by: Roland Hieber <rhi@pengutronix.de>
  66 Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
  67 Tested-by: Roland Hieber <rhi@pengutronix.de>
  68 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  69 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  70
  71 ---
  72  drivers/crypto/caam/caamhash.c |   85 ++++++++++-------------------------------
  73  1 file changed, 21 insertions(+), 64 deletions(-)
  74
  75 --- a/drivers/crypto/caam/caamhash.c
  76 +++ b/drivers/crypto/caam/caamhash.c
  77 @@ -185,18 +185,6 @@ static inline int map_seq_out_ptr_ctx(u3
  78         return 0;
  79  }
  80
  81 -/* Map req->result, and append seq_out_ptr command that points to it */
  82 -static inline dma_addr_t map_seq_out_ptr_result(u32 *desc, struct device *jrdev,
  83 -                                               u8 *result, int digestsize)
  84 -{
  85 -       dma_addr_t dst_dma;
  86 -
  87 -       dst_dma = dma_map_single(jrdev, result, digestsize, DMA_FROM_DEVICE);
  88 -       append_seq_out_ptr(desc, dst_dma, digestsize, 0);
  89 -
  90 -       return dst_dma;
  91 -}
  92 -
  93  /* Map current buffer in state (if length > 0) and put it in link table */
  94  static inline int buf_map_to_sec4_sg(struct device *jrdev,
  95                                      struct sec4_sg_entry *sec4_sg,
  96 @@ -488,7 +476,6 @@ static int ahash_setkey(struct crypto_ah
  97
  98  /*
  99   * ahash_edesc - s/w-extended ahash descriptor
 100 - * @dst_dma: physical mapped address of req->result
 101   * @sec4_sg_dma: physical mapped address of h/w link table
 102   * @src_nents: number of segments in input scatterlist
 103   * @sec4_sg_bytes: length of dma mapped sec4_sg space
 104 @@ -496,7 +483,6 @@ static int ahash_setkey(struct crypto_ah
 105   * @sec4_sg: h/w link table
 106   */
 107  struct ahash_edesc {
 108 -       dma_addr_t dst_dma;
 109         dma_addr_t sec4_sg_dma;
 110         int src_nents;
 111         int sec4_sg_bytes;
 112 @@ -512,8 +498,6 @@ static inline void ahash_unmap(struct de
 113
 114         if (edesc->src_nents)
 115                 dma_unmap_sg(dev, req->src, edesc->src_nents, DMA_TO_DEVICE);
 116 -       if (edesc->dst_dma)
 117 -               dma_unmap_single(dev, edesc->dst_dma, dst_len, DMA_FROM_DEVICE);
 118
 119         if (edesc->sec4_sg_bytes)
 120                 dma_unmap_single(dev, edesc->sec4_sg_dma,
 121 @@ -546,9 +530,9 @@ static void ahash_done(struct device *jr
 122         struct ahash_edesc *edesc;
 123         struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
 124         int digestsize = crypto_ahash_digestsize(ahash);
 125 +       struct caam_hash_state *state = ahash_request_ctx(req);
 126  #ifdef DEBUG
 127         struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash);
 128 -       struct caam_hash_state *state = ahash_request_ctx(req);
 129
 130         dev_err(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err);
 131  #endif
 132 @@ -557,17 +541,14 @@ static void ahash_done(struct device *jr
 133         if (err)
 134                 caam_jr_strstatus(jrdev, err);
 135
 136 -       ahash_unmap(jrdev, edesc, req, digestsize);
 137 +       ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
 138 +       memcpy(req->result, state->caam_ctx, digestsize);
 139         kfree(edesc);
 140
 141  #ifdef DEBUG
 142         print_hex_dump(KERN_ERR, "ctx@"__stringify(__LINE__)": ",
 143                        DUMP_PREFIX_ADDRESS, 16, 4, state->caam_ctx,
 144                        ctx->ctx_len, 1);
 145 -       if (req->result)
 146 -               print_hex_dump(KERN_ERR, "result@"__stringify(__LINE__)": ",
 147 -                              DUMP_PREFIX_ADDRESS, 16, 4, req->result,
 148 -                              digestsize, 1);
 149  #endif
 150
 151         req->base.complete(&req->base, err);
 152 @@ -615,9 +596,9 @@ static void ahash_done_ctx_src(struct de
 153         struct ahash_edesc *edesc;
 154         struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
 155         int digestsize = crypto_ahash_digestsize(ahash);
 156 +       struct caam_hash_state *state = ahash_request_ctx(req);
 157  #ifdef DEBUG
 158         struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash);
 159 -       struct caam_hash_state *state = ahash_request_ctx(req);
 160
 161         dev_err(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err);
 162  #endif
 163 @@ -626,17 +607,14 @@ static void ahash_done_ctx_src(struct de
 164         if (err)
 165                 caam_jr_strstatus(jrdev, err);
 166
 167 -       ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_TO_DEVICE);
 168 +       ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_BIDIRECTIONAL);
 169 +       memcpy(req->result, state->caam_ctx, digestsize);
 170         kfree(edesc);
 171
 172  #ifdef DEBUG
 173         print_hex_dump(KERN_ERR, "ctx@"__stringify(__LINE__)": ",
 174                        DUMP_PREFIX_ADDRESS, 16, 4, state->caam_ctx,
 175                        ctx->ctx_len, 1);
 176 -       if (req->result)
 177 -               print_hex_dump(KERN_ERR, "result@"__stringify(__LINE__)": ",
 178 -                              DUMP_PREFIX_ADDRESS, 16, 4, req->result,
 179 -                              digestsize, 1);
 180  #endif
 181
 182         req->base.complete(&req->base, err);
 183 @@ -897,7 +875,7 @@ static int ahash_final_ctx(struct ahash_
 184         edesc->sec4_sg_bytes = sec4_sg_bytes;
 185
 186         ret = ctx_map_to_sec4_sg(jrdev, state, ctx->ctx_len,
 187 -                                edesc->sec4_sg, DMA_TO_DEVICE);
 188 +                                edesc->sec4_sg, DMA_BIDIRECTIONAL);
 189         if (ret)
 190                 goto unmap_ctx;
 191
 192 @@ -917,14 +895,7 @@ static int ahash_final_ctx(struct ahash_
 193
 194         append_seq_in_ptr(desc, edesc->sec4_sg_dma, ctx->ctx_len + buflen,
 195                           LDST_SGF);
 196 -
 197 -       edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
 198 -                                               digestsize);
 199 -       if (dma_mapping_error(jrdev, edesc->dst_dma)) {
 200 -               dev_err(jrdev, "unable to map dst\n");
 201 -               ret = -ENOMEM;
 202 -               goto unmap_ctx;
 203 -       }
 204 +       append_seq_out_ptr(desc, state->ctx_dma, digestsize, 0);
 205
 206  #ifdef DEBUG
 207         print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
 208 @@ -937,7 +908,7 @@ static int ahash_final_ctx(struct ahash_
 209
 210         return -EINPROGRESS;
 211   unmap_ctx:
 212 -       ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
 213 +       ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_BIDIRECTIONAL);
 214         kfree(edesc);
 215         return ret;
 216  }
 217 @@ -991,7 +962,7 @@ static int ahash_finup_ctx(struct ahash_
 218         edesc->src_nents = src_nents;
 219
 220         ret = ctx_map_to_sec4_sg(jrdev, state, ctx->ctx_len,
 221 -                                edesc->sec4_sg, DMA_TO_DEVICE);
 222 +                                edesc->sec4_sg, DMA_BIDIRECTIONAL);
 223         if (ret)
 224                 goto unmap_ctx;
 225
 226 @@ -1005,13 +976,7 @@ static int ahash_finup_ctx(struct ahash_
 227         if (ret)
 228                 goto unmap_ctx;
 229
 230 -       edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
 231 -                                               digestsize);
 232 -       if (dma_mapping_error(jrdev, edesc->dst_dma)) {
 233 -               dev_err(jrdev, "unable to map dst\n");
 234 -               ret = -ENOMEM;
 235 -               goto unmap_ctx;
 236 -       }
 237 +       append_seq_out_ptr(desc, state->ctx_dma, digestsize, 0);
 238
 239  #ifdef DEBUG
 240         print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
 241 @@ -1024,7 +989,7 @@ static int ahash_finup_ctx(struct ahash_
 242
 243         return -EINPROGRESS;
 244   unmap_ctx:
 245 -       ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
 246 +       ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_BIDIRECTIONAL);
 247         kfree(edesc);
 248         return ret;
 249  }
 250 @@ -1083,10 +1048,8 @@ static int ahash_digest(struct ahash_req
 251
 252         desc = edesc->hw_desc;
 253
 254 -       edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
 255 -                                               digestsize);
 256 -       if (dma_mapping_error(jrdev, edesc->dst_dma)) {
 257 -               dev_err(jrdev, "unable to map dst\n");
 258 +       ret = map_seq_out_ptr_ctx(desc, jrdev, state, digestsize);
 259 +       if (ret) {
 260                 ahash_unmap(jrdev, edesc, req, digestsize);
 261                 kfree(edesc);
 262                 return -ENOMEM;
 263 @@ -1101,7 +1064,7 @@ static int ahash_digest(struct ahash_req
 264         if (!ret) {
 265                 ret = -EINPROGRESS;
 266         } else {
 267 -               ahash_unmap(jrdev, edesc, req, digestsize);
 268 +               ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
 269                 kfree(edesc);
 270         }
 271
 272 @@ -1143,12 +1106,9 @@ static int ahash_final_no_ctx(struct aha
 273                 append_seq_in_ptr(desc, state->buf_dma, buflen, 0);
 274         }
 275
 276 -       edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
 277 -                                               digestsize);
 278 -       if (dma_mapping_error(jrdev, edesc->dst_dma)) {
 279 -               dev_err(jrdev, "unable to map dst\n");
 280 +       ret = map_seq_out_ptr_ctx(desc, jrdev, state, digestsize);
 281 +       if (ret)
 282                 goto unmap;
 283 -       }
 284
 285  #ifdef DEBUG
 286         print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
 287 @@ -1159,7 +1119,7 @@ static int ahash_final_no_ctx(struct aha
 288         if (!ret) {
 289                 ret = -EINPROGRESS;
 290         } else {
 291 -               ahash_unmap(jrdev, edesc, req, digestsize);
 292 +               ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
 293                 kfree(edesc);
 294         }
 295
 296 @@ -1358,12 +1318,9 @@ static int ahash_finup_no_ctx(struct aha
 297                 goto unmap;
 298         }
 299
 300 -       edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
 301 -                                               digestsize);
 302 -       if (dma_mapping_error(jrdev, edesc->dst_dma)) {
 303 -               dev_err(jrdev, "unable to map dst\n");
 304 +       ret = map_seq_out_ptr_ctx(desc, jrdev, state, digestsize);
 305 +       if (ret)
 306                 goto unmap;
 307 -       }
 308
 309  #ifdef DEBUG
 310         print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
 311 @@ -1374,7 +1331,7 @@ static int ahash_finup_no_ctx(struct aha
 312         if (!ret) {
 313                 ret = -EINPROGRESS;
 314         } else {
 315 -               ahash_unmap(jrdev, edesc, req, digestsize);
 316 +               ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
 317                 kfree(edesc);
 318         }
 319