From patchwork Thu Jul 28 05:29:17 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Herbert Xu X-Patchwork-Id: 9250679 X-Patchwork-Delegate: herbert@gondor.apana.org.au Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 693486075F for ; Thu, 28 Jul 2016 05:29:25 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5914D1FF60 for ; Thu, 28 Jul 2016 05:29:25 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4D9A3254F7; Thu, 28 Jul 2016 05:29:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 90BB01FF60 for ; Thu, 28 Jul 2016 05:29:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751361AbcG1F3X (ORCPT ); Thu, 28 Jul 2016 01:29:23 -0400 Received: from helcar.hengli.com.au ([209.40.204.226]:53285 "EHLO helcar.hengli.com.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754537AbcG1F3W (ORCPT ); Thu, 28 Jul 2016 01:29:22 -0400 Received: from gondolin.me.apana.org.au ([192.168.0.6]) by norbury.hengli.com.au with esmtp (Exim 4.80 #3 (Debian)) id 1bSdsl-0007AF-JK; Thu, 28 Jul 2016 15:29:19 +1000 Received: from herbert by gondolin.me.apana.org.au with local (Exim 4.80) (envelope-from ) id 1bSdsk-0000Dm-07; Thu, 28 Jul 2016 13:29:18 +0800 Date: Thu, 28 Jul 2016 13:29:17 +0800 From: Herbert Xu To: Nicolai Stange Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: lib/mpi: BUG: sleeping function called from invalid context on next-20160726 Message-ID: <20160728052917.GA811@gondor.apana.org.au> References: <87d1lyiygu.fsf@gmail.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <87d1lyiygu.fsf@gmail.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Wed, Jul 27, 2016 at 11:05:05PM +0200, Nicolai Stange wrote: > > with linux-next-20160726, I get this: > > BUG: sleeping function called from invalid context at /mnt/scratch/nic/linux-next/mm/slab.h:388 Does this patch help? > I would have sent a patch, but there is another point which puzzles me > in mpi_read_raw_from_sgl(): > > [...] > const u8 *buff; > [...] > sg_miter_start(&miter, sgl, ents, SG_MITER_ATOMIC | SG_MITER_FROM_SG); > > lzeros = 0; > len = 0; > while (nbytes > 0) { > while (len && !*buff) { > lzeros++; > len--; > buff++; > } > > > Thus, buff isn't initialized before its first use? Or am I misreading > something here? On the first entry len is zero therefore we will go to the end of the loop and initialise buff. Anyway, it will no longer be as confusing with this patch applied. Thanks, ---8<--- Subject: lib/mpi: Fix SG miter leak In mpi_read_raw_from_sgl we may leak the SG miter resouces after reading the leading zeroes. This patch fixes this by stopping the iteration once the leading zeroes have been read. Fixes: 127827b9c295 ("lib/mpi: Do not do sg_virt") Reported-by: Nicolai Stange Signed-off-by: Herbert Xu diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c index c6272ae..5a0f75a 100644 --- a/lib/mpi/mpicoder.c +++ b/lib/mpi/mpicoder.c @@ -363,6 +363,9 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) lzeros = 0; } + miter.consumed = lzeros; + sg_miter_stop(&miter); + nbytes -= lzeros; nbits = nbytes * 8; if (nbits > MAX_EXTERN_MPI_BITS) { @@ -390,7 +393,10 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) z = BYTES_PER_MPI_LIMB - nbytes % BYTES_PER_MPI_LIMB; z %= BYTES_PER_MPI_LIMB; - for (;;) { + while (sg_miter_next(&miter)) { + buff = miter.addr; + len = miter.length; + for (x = 0; x < len; x++) { a <<= 8; a |= *buff++; @@ -400,12 +406,6 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) } } z += x; - - if (!sg_miter_next(&miter)) - break; - - buff = miter.addr; - len = miter.length; } return val;