netdev - Re: [PATCH net] ipv6: sr: fix BUG in HMAC init when preemption is enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 Jan 2017 10:16:29 -0800
From:   ericnetdev dumazet <erdnetdev@...il.com>
To:     David Lebrun <david.lebrun@...ouvain.be>
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH net] ipv6: sr: fix BUG in HMAC init when preemption is enabled

2017-01-10 5:39 GMT-08:00 David Lebrun <david.lebrun@...ouvain.be>:
> When CONFIG_PREEMPT=y, CONFIG_IPV6=m and CONFIG_SEG6_HMAC=y,
> seg6_hmac_init() is called during the initialization of the ipv6 module.
> This causes a subsequent call to smp_processor_id() with preemption
> enabled, resulting in the following trace.

I disagree with  your fix.  Keeping GFP_KERNEL for all these per cpu
allocations is needed.

What about the simpler :

Rationale : we only need to get the size of the allocation, we do not
care of migration here, all cpus having the same allocation.

Another issue with this is code is that in case of an allocation
error, no cleanup is performed to free prior allocations.

diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c
index ef1c8a46e7aceee45b2044d4b4338dc3aed88807..b31d682816503129e12d3eae5b70a8cbce8525a7
100644
--- a/net/ipv6/seg6_hmac.c
+++ b/net/ipv6/seg6_hmac.c
@@ -400,7 +400,7 @@ static int seg6_hmac_init_algo(void)
                        *p_tfm = tfm;
                }

-               p_tfm = this_cpu_ptr(algo->tfms);
+               p_tfm = __this_cpu_ptr(algo->tfms);
                tfm = *p_tfm;

                shsize = sizeof(*shash) + crypto_shash_descsize(tfm);