summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid Miller <davem@davemloft.net>2017-06-02 11:28:54 -0400
committerHerbert Xu <herbert@gondor.apana.org.au>2017-06-08 05:36:03 -0400
commitd41519a69b35b10af7fda867fb9100df24fdf403 (patch)
treed71a478fac542c5415282463a1d3428adb26aeca
parentf3ad587070d6bd961ab942b3fd7a85d00dfc934b (diff)
crypto: Work around deallocated stack frame reference gcc bug on sparc.
On sparc, if we have an alloca() like situation, as is the case with SHASH_DESC_ON_STACK(), we can end up referencing deallocated stack memory. The result can be that the value is clobbered if a trap or interrupt arrives at just the right instruction. It only occurs if the function ends returning a value from that alloca() area and that value can be placed into the return value register using a single instruction. For example, in lib/libcrc32c.c:crc32c() we end up with a return sequence like: return %i7+8 lduw [%o5+16], %o0 ! MEM[(u32 *)__shash_desc.1_10 + 16B], %o5 holds the base of the on-stack area allocated for the shash descriptor. But the return released the stack frame and the register window. So if an intererupt arrives between 'return' and 'lduw', then the value read at %o5+16 can be corrupted. Add a data compiler barrier to work around this problem. This is exactly what the gcc fix will end up doing as well, and it absolutely should not change the code generated for other cpus (unless gcc on them has the same bug :-) With crucial insight from Eric Sandeen. Cc: <stable@vger.kernel.org> Reported-by: Anatoly Pugachev <matorola@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-rw-r--r--drivers/infiniband/sw/rxe/rxe.h5
-rw-r--r--fs/btrfs/hash.c5
-rw-r--r--fs/f2fs/f2fs.h5
-rw-r--r--lib/libcrc32c.c6
4 files changed, 16 insertions, 5 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
index ecdba2fce083..1ac5b8551a4d 100644
--- a/drivers/infiniband/sw/rxe/rxe.h
+++ b/drivers/infiniband/sw/rxe/rxe.h
@@ -68,6 +68,7 @@
68static inline u32 rxe_crc32(struct rxe_dev *rxe, 68static inline u32 rxe_crc32(struct rxe_dev *rxe,
69 u32 crc, void *next, size_t len) 69 u32 crc, void *next, size_t len)
70{ 70{
71 u32 retval;
71 int err; 72 int err;
72 73
73 SHASH_DESC_ON_STACK(shash, rxe->tfm); 74 SHASH_DESC_ON_STACK(shash, rxe->tfm);
@@ -81,7 +82,9 @@ static inline u32 rxe_crc32(struct rxe_dev *rxe,
81 return crc32_le(crc, next, len); 82 return crc32_le(crc, next, len);
82 } 83 }
83 84
84 return *(u32 *)shash_desc_ctx(shash); 85 retval = *(u32 *)shash_desc_ctx(shash);
86 barrier_data(shash_desc_ctx(shash));
87 return retval;
85} 88}
86 89
87int rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu); 90int rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu);
diff --git a/fs/btrfs/hash.c b/fs/btrfs/hash.c
index a97fdc156a03..baacc1866861 100644
--- a/fs/btrfs/hash.c
+++ b/fs/btrfs/hash.c
@@ -38,6 +38,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length)
38{ 38{
39 SHASH_DESC_ON_STACK(shash, tfm); 39 SHASH_DESC_ON_STACK(shash, tfm);
40 u32 *ctx = (u32 *)shash_desc_ctx(shash); 40 u32 *ctx = (u32 *)shash_desc_ctx(shash);
41 u32 retval;
41 int err; 42 int err;
42 43
43 shash->tfm = tfm; 44 shash->tfm = tfm;
@@ -47,5 +48,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length)
47 err = crypto_shash_update(shash, address, length); 48 err = crypto_shash_update(shash, address, length);
48 BUG_ON(err); 49 BUG_ON(err);
49 50
50 return *ctx; 51 retval = *ctx;
52 barrier_data(ctx);
53 return retval;
51} 54}
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 2185c7a040a1..fd2e651bad6d 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -1078,6 +1078,7 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address,
1078{ 1078{
1079 SHASH_DESC_ON_STACK(shash, sbi->s_chksum_driver); 1079 SHASH_DESC_ON_STACK(shash, sbi->s_chksum_driver);
1080 u32 *ctx = (u32 *)shash_desc_ctx(shash); 1080 u32 *ctx = (u32 *)shash_desc_ctx(shash);
1081 u32 retval;
1081 int err; 1082 int err;
1082 1083
1083 shash->tfm = sbi->s_chksum_driver; 1084 shash->tfm = sbi->s_chksum_driver;
@@ -1087,7 +1088,9 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address,
1087 err = crypto_shash_update(shash, address, length); 1088 err = crypto_shash_update(shash, address, length);
1088 BUG_ON(err); 1089 BUG_ON(err);
1089 1090
1090 return *ctx; 1091 retval = *ctx;
1092 barrier_data(ctx);
1093 return retval;
1091} 1094}
1092 1095
1093static inline bool f2fs_crc_valid(struct f2fs_sb_info *sbi, __u32 blk_crc, 1096static inline bool f2fs_crc_valid(struct f2fs_sb_info *sbi, __u32 blk_crc,
diff --git a/lib/libcrc32c.c b/lib/libcrc32c.c
index 74a54b7f2562..9f79547d1b97 100644
--- a/lib/libcrc32c.c
+++ b/lib/libcrc32c.c
@@ -43,7 +43,7 @@ static struct crypto_shash *tfm;
43u32 crc32c(u32 crc, const void *address, unsigned int length) 43u32 crc32c(u32 crc, const void *address, unsigned int length)
44{ 44{
45 SHASH_DESC_ON_STACK(shash, tfm); 45 SHASH_DESC_ON_STACK(shash, tfm);
46 u32 *ctx = (u32 *)shash_desc_ctx(shash); 46 u32 ret, *ctx = (u32 *)shash_desc_ctx(shash);
47 int err; 47 int err;
48 48
49 shash->tfm = tfm; 49 shash->tfm = tfm;
@@ -53,7 +53,9 @@ u32 crc32c(u32 crc, const void *address, unsigned int length)
53 err = crypto_shash_update(shash, address, length); 53 err = crypto_shash_update(shash, address, length);
54 BUG_ON(err); 54 BUG_ON(err);
55 55
56 return *ctx; 56 ret = *ctx;
57 barrier_data(ctx);
58 return ret;
57} 59}
58 60
59EXPORT_SYMBOL(crc32c); 61EXPORT_SYMBOL(crc32c);