FAILED: patch "[PATCH] crypto: Work around deallocated stack frame reference gcc bug" failed to apply to 4.11-stable tree
Subsystems (6)
[email protected]
maintainerThe patch below does not apply to the 4.11-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
Quoted 1 line
From
d41519a69b35b10af7fda867fb9100df24fdf403Mon Sep 17 00:00:00 2001
From: David Miller <[email protected]>
Date: Fri, 2 Jun 2017 11:28:54 -0400
Subject: [PATCH] crypto: Work around deallocated stack frame reference gcc bug
on sparc.
On sparc, if we have an alloca() like situation, as is the case with SHASH_DESC_ON_STACK(), we can end up referencing deallocated stack memory. The result can be that the value is clobbered if a trap or interrupt arrives at just the right instruction.
It only occurs if the function ends returning a value from that alloca() area and that value can be placed into the return value register using a single instruction.
For example, in lib/libcrc32c.c:crc32c() we end up with a return sequence like:
return %i7+8
lduw [%o5+16], %o0 ! MEM[(u32 *)__shash_desc.1_10 + 16B],%o5 holds the base of the on-stack area allocated for the shash descriptor. But the return released the stack frame and the register window.
So if an intererupt arrives between 'return' and 'lduw', then the value read at %o5+16 can be corrupted.
Add a data compiler barrier to work around this problem. This is exactly what the gcc fix will end up doing as well, and it absolutely should not change the code generated for other cpus (unless gcc on them has the same bug :-)
With crucial insight from Eric Sandeen.
drivers/infiniband/sw/rxe/rxe.h +4 -1
@@ -68,6 +68,7 @@static inline u32 rxe_crc32 (struct rxe_dev *rxe,u32 crc,void *next,size_t len) { +u32 retval;int err;SHASH_DESC_ON_STACK (shash, rxe->tfm);
@@ -81,7 +82,9 @@ static inline u32 rxe_crc32(struct rxe_dev *rxe,return crc32_le (crc, next, len); } -return *(u32 *)shash_desc_ctx (shash); + retval = *(u32 *)shash_desc_ctx (shash); +barrier_data (shash_desc_ctx (shash)); +return retval; }int rxe_set_mtu (struct rxe_dev *rxe,unsigned int dev_mtu);
fs/btrfs/hash.c +4 -1
@@ -38,6 +38,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length) {SHASH_DESC_ON_STACK (shash, tfm);u32 *ctx = (u32 *)shash_desc_ctx (shash); +u32 retval;int err; shash->tfm = tfm;
@@ -47,5 +48,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length) err =crypto_shash_update (shash, address, length);BUG_ON (err); -return *ctx; + retval = *ctx; +barrier_data (ctx); +return retval; }
fs/f2fs/f2fs.h +4 -1
@@ -1078,6 +1078,7 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address, {SHASH_DESC_ON_STACK (shash, sbi->s_chksum_driver);u32 *ctx = (u32 *)shash_desc_ctx (shash); +u32 retval;int err; shash->tfm = sbi->s_chksum_driver;
@@ -1087,7 +1088,9 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address, err =crypto_shash_update (shash, address, length);BUG_ON (err); -return *ctx; + retval = *ctx; +barrier_data (ctx); +return retval; } static inline bool f2fs_crc_valid(struct f2fs_sb_info *sbi, __u32 blk_crc,
lib/libcrc32c.c +4 -2
@@ -43,7 +43,7 @@ static struct crypto_shash *tfm;u32 crc32c (u32 crc,const void *address,unsigned int length) {SHASH_DESC_ON_STACK (shash, tfm); -u32 *ctx = (u32 *)shash_desc_ctx (shash); +u32 ret, *ctx = (u32 *)shash_desc_ctx (shash);int err; shash->tfm = tfm;
@@ -53,7 +53,9 @@ u32 crc32c(u32 crc, const void *address, unsigned int length) err =crypto_shash_update (shash, address, length);BUG_ON (err); -return *ctx; + ret = *ctx; +barrier_data (ctx); +return ret; }EXPORT_SYMBOL (crc32c);
From: <[email protected]>
Date: Sat, 17 Jun 2017 19:29:48 +0200
Quoted 4 lines
The patch below does not apply to the 4.11-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
Here is a version that applies.
====================
Quoted 1 line
From
158d4715ad4867853732e007fa13fd594619be69Mon Sep 17 00:00:00 2001
From: David Miller <[email protected]>
Date: Fri, 2 Jun 2017 11:28:54 -0400
Subject: [PATCH] crypto: Work around deallocated stack frame reference gcc bug
on sparc.
[ Upstream commit d41519a69b35b10af7fda867fb9100df24fdf403 ]
On sparc, if we have an alloca() like situation, as is the case with SHASH_DESC_ON_STACK(), we can end up referencing deallocated stack memory. The result can be that the value is clobbered if a trap or interrupt arrives at just the right instruction.
It only occurs if the function ends returning a value from that alloca() area and that value can be placed into the return value register using a single instruction.
For example, in lib/libcrc32c.c:crc32c() we end up with a return sequence like:
return %i7+8
lduw [%o5+16], %o0 ! MEM[(u32 *)__shash_desc.1_10 + 16B],%o5 holds the base of the on-stack area allocated for the shash descriptor. But the return released the stack frame and the register window.
So if an intererupt arrives between 'return' and 'lduw', then the value read at %o5+16 can be corrupted.
Add a data compiler barrier to work around this problem. This is exactly what the gcc fix will end up doing as well, and it absolutely should not change the code generated for other cpus (unless gcc on them has the same bug :-)
With crucial insight from Eric Sandeen.
--- fs/btrfs/hash.c | 5 ++++- fs/f2fs/f2fs.h | 5 ++++- lib/libcrc32c.c | 6 ++++-- 3 files changed, 12 insertions(+), 4 deletions(-)
fs/btrfs/hash.c +4 -1
@@ -38,6 +38,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length) {SHASH_DESC_ON_STACK (shash, tfm);u32 *ctx = (u32 *)shash_desc_ctx (shash); +u32 retval;int err; shash->tfm = tfm;
@@ -47,5 +48,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length) err =crypto_shash_update (shash, address, length);BUG_ON (err); -return *ctx; + retval = *ctx; +barrier_data (ctx); +return retval; }
fs/f2fs/f2fs.h +4 -1
@@ -1007,6 +1007,7 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address, {SHASH_DESC_ON_STACK (shash, sbi->s_chksum_driver);u32 *ctx = (u32 *)shash_desc_ctx (shash); +u32 retval;int err; shash->tfm = sbi->s_chksum_driver;
@@ -1016,7 +1017,9 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address, err =crypto_shash_update (shash, address, length);BUG_ON (err); -return *ctx; + retval = *ctx; +barrier_data (ctx); +return retval; } static inline bool f2fs_crc_valid(struct f2fs_sb_info *sbi, __u32 blk_crc,
lib/libcrc32c.c +4 -2
@@ -43,7 +43,7 @@ static struct crypto_shash *tfm;u32 crc32c (u32 crc,const void *address,unsigned int length) {SHASH_DESC_ON_STACK (shash, tfm); -u32 *ctx = (u32 *)shash_desc_ctx (shash); +u32 ret, *ctx = (u32 *)shash_desc_ctx (shash);int err; shash->tfm = tfm;
@@ -53,7 +53,9 @@ u32 crc32c(u32 crc, const void *address, unsigned int length) err =crypto_shash_update (shash, address, length);BUG_ON (err); -return *ctx; + ret = *ctx; +barrier_data (ctx); +return ret; }EXPORT_SYMBOL (crc32c);
Signature · 1 line
2.9.4
Greg KH
maintainerQuoted 9 lines · David Miller
From: <[email protected]>
Date: Sat, 17 Jun 2017 19:29:48 +0200Quoted 4 lines
The patch below does not apply to the 4.11-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.Here is a version that applies.
Wonderful, now queued up for 4.11 and 4.9 stable kernels.
greg k-h