--- /dev/null
+From yangerkun@huawei.com Tue Mar 10 13:13:31 2020
+From: yangerkun <yangerkun@huawei.com>
+Date: Thu, 5 Mar 2020 16:57:55 +0800
+Subject: crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async
+To: <gregkh@linuxfoundation.org>, <herbert@gondor.apana.org.au>
+Cc: <stable@vger.kernel.org>, <linux-crypto@vger.kernel.org>, <yangerkun@huawei.com>
+Message-ID: <20200305085755.22730-1-yangerkun@huawei.com>
+
+From: yangerkun <yangerkun@huawei.com>
+
+Nowdays, we trigger a oops:
+...
+kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] SMP KASAN
+...
+Call Trace:
+ [<ffffffff81a26fb1>] skcipher_recvmsg_async+0x3f1/0x1400 x86/../crypto/algif_skcipher.c:543
+ [<ffffffff81a28053>] skcipher_recvmsg+0x93/0x7f0 x86/../crypto/algif_skcipher.c:723
+ [<ffffffff823e43a4>] sock_recvmsg_nosec x86/../net/socket.c:702 [inline]
+ [<ffffffff823e43a4>] sock_recvmsg x86/../net/socket.c:710 [inline]
+ [<ffffffff823e43a4>] sock_recvmsg+0x94/0xc0 x86/../net/socket.c:705
+ [<ffffffff823e464b>] sock_read_iter+0x27b/0x3a0 x86/../net/socket.c:787
+ [<ffffffff817f479b>] aio_run_iocb+0x21b/0x7a0 x86/../fs/aio.c:1520
+ [<ffffffff817f57c9>] io_submit_one x86/../fs/aio.c:1630 [inline]
+ [<ffffffff817f57c9>] do_io_submit+0x6b9/0x10b0 x86/../fs/aio.c:1688
+ [<ffffffff817f902d>] SYSC_io_submit x86/../fs/aio.c:1713 [inline]
+ [<ffffffff817f902d>] SyS_io_submit+0x2d/0x40 x86/../fs/aio.c:1710
+ [<ffffffff828b33c3>] tracesys_phase2+0x90/0x95
+
+In skcipher_recvmsg_async, we use '!sreq->tsg' to determine does we
+calloc fail. However, kcalloc may return ZERO_SIZE_PTR, and with this,
+the latter sg_init_table will trigger the bug. Fix it be use ZERO_OF_NULL_PTR.
+
+This function was introduced with ' commit a596999b7ddf ("crypto:
+algif - change algif_skcipher to be asynchronous")', and has been removed
+with 'commit e870456d8e7c ("crypto: algif_skcipher - overhaul memory
+management")'.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: yangerkun <yangerkun@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/algif_skcipher.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+v1->v2:
+update the commit message
+
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index d12782dc9683..9bd4691cc5c5 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -538,7 +538,7 @@ static int skcipher_recvmsg_async(struct socket *sock, struct msghdr *msg,
+ lock_sock(sk);
+ tx_nents = skcipher_all_sg_nents(ctx);
+ sreq->tsg = kcalloc(tx_nents, sizeof(*sg), GFP_KERNEL);
+- if (unlikely(!sreq->tsg))
++ if (unlikely(ZERO_OR_NULL_PTR(sreq->tsg)))
+ goto unlock;
+ sg_init_table(sreq->tsg, tx_nents);
+ memcpy(iv, ctx->iv, ivsize);
+--
+2.17.2
+
--- /dev/null
+From 53770f0ec5fd417429775ba006bc4abe14002335 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 17 Feb 2020 07:43:03 -0500
+Subject: dm integrity: fix a deadlock due to offloading to an incorrect workqueue
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 53770f0ec5fd417429775ba006bc4abe14002335 upstream.
+
+If we need to perform synchronous I/O in dm_integrity_map_continue(),
+we must make sure that we are not in the map function - in order to
+avoid the deadlock due to bio queuing in generic_make_request. To
+avoid the deadlock, we offload the request to metadata_wq.
+
+However, metadata_wq also processes metadata updates for write requests.
+If there are too many requests that get offloaded to metadata_wq at the
+beginning of dm_integrity_map_continue, the workqueue metadata_wq
+becomes clogged and the system is incapable of processing any metadata
+updates.
+
+This causes a deadlock because all the requests that need to do metadata
+updates wait for metadata_wq to proceed and metadata_wq waits inside
+wait_and_add_new_range until some existing request releases its range
+lock (which doesn't happen because the range lock is released after
+metadata update).
+
+In order to fix the deadlock, we create a new workqueue offload_wq and
+offload requests to it - so that processing of offload_wq is independent
+from processing of metadata_wq.
+
+Fixes: 7eada909bfd7 ("dm: add integrity target")
+Cc: stable@vger.kernel.org # v4.12+
+Reported-by: Heinz Mauelshagen <heinzm@redhat.com>
+Tested-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-integrity.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -187,6 +187,7 @@ struct dm_integrity_c {
+ struct rb_root in_progress;
+ wait_queue_head_t endio_wait;
+ struct workqueue_struct *wait_wq;
++ struct workqueue_struct *offload_wq;
+
+ unsigned char commit_seq;
+ commit_id_t commit_ids[N_COMMIT_IDS];
+@@ -1157,7 +1158,7 @@ static void dec_in_flight(struct dm_inte
+ dio->range.logical_sector += dio->range.n_sectors;
+ bio_advance(bio, dio->range.n_sectors << SECTOR_SHIFT);
+ INIT_WORK(&dio->work, integrity_bio_wait);
+- queue_work(ic->wait_wq, &dio->work);
++ queue_work(ic->offload_wq, &dio->work);
+ return;
+ }
+ do_endio_flush(ic, dio);
+@@ -1577,7 +1578,7 @@ static void dm_integrity_map_continue(st
+
+ if (need_sync_io && from_map) {
+ INIT_WORK(&dio->work, integrity_bio_wait);
+- queue_work(ic->metadata_wq, &dio->work);
++ queue_work(ic->offload_wq, &dio->work);
+ return;
+ }
+
+@@ -3005,6 +3006,14 @@ static int dm_integrity_ctr(struct dm_ta
+ goto bad;
+ }
+
++ ic->offload_wq = alloc_workqueue("dm-integrity-offload", WQ_MEM_RECLAIM,
++ METADATA_WORKQUEUE_MAX_ACTIVE);
++ if (!ic->offload_wq) {
++ ti->error = "Cannot allocate workqueue";
++ r = -ENOMEM;
++ goto bad;
++ }
++
+ ic->commit_wq = alloc_workqueue("dm-integrity-commit", WQ_MEM_RECLAIM, 1);
+ if (!ic->commit_wq) {
+ ti->error = "Cannot allocate workqueue";
+@@ -3189,6 +3198,8 @@ static void dm_integrity_dtr(struct dm_t
+ destroy_workqueue(ic->metadata_wq);
+ if (ic->wait_wq)
+ destroy_workqueue(ic->wait_wq);
++ if (ic->offload_wq)
++ destroy_workqueue(ic->offload_wq);
+ if (ic->commit_wq)
+ destroy_workqueue(ic->commit_wq);
+ if (ic->writer_wq)
hwmon-adt7462-fix-an-error-return-in-adt7462_reg_volt.patch
dmaengine-coh901318-fix-a-double-lock-bug-in-dma_tc_handle.patch
powerpc-fix-hardware-pmu-exception-bug-on-powervm-compatibility-mode-systems.patch
+dm-integrity-fix-a-deadlock-due-to-offloading-to-an-incorrect-workqueue.patch
+xhci-handle-port-status-events-for-removed-usb3-hcd.patch
+crypto-algif_skcipher-use-zero_or_null_ptr-in-skcipher_recvmsg_async.patch
--- /dev/null
+From 1245374e9b8340fc255fd51b2015173a83050d03 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 9 Nov 2018 17:21:18 +0200
+Subject: xhci: handle port status events for removed USB3 hcd
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 1245374e9b8340fc255fd51b2015173a83050d03 upstream.
+
+At xhci removal the USB3 hcd (shared_hcd) is removed before the primary
+USB2 hcd. Interrupts for port status changes may still occur for USB3
+ports after the shared_hcd is freed, causing NULL pointer dereference.
+
+Check if xhci->shared_hcd is still valid before handing USB3 port events
+
+Cc: <stable@vger.kernel.org>
+Reported-by: Peter Chen <peter.chen@nxp.com>
+Tested-by: Jack Pham <jackp@codeaurora.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Cc: Macpaul Lin <macpaul.lin@mediatek.com>
+[redone for 4.14.y based on Mathias's comments]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1640,6 +1640,12 @@ static void handle_port_status(struct xh
+ if ((major_revision == 0x03) != (hcd->speed >= HCD_USB3))
+ hcd = xhci->shared_hcd;
+
++ if (!hcd) {
++ xhci_dbg(xhci, "No hcd found for port %u event\n", port_id);
++ bogus_port_status = true;
++ goto cleanup;
++ }
++
+ if (major_revision == 0) {
+ xhci_warn(xhci, "Event for port %u not in "
+ "Extended Capabilities, ignoring.\n",
projects / thirdparty / kernel / stable-queue.git / commitdiff
