From patchwork Sat Sep 10 03:42:51 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephan Mueller X-Patchwork-Id: 9324697 X-Patchwork-Delegate: herbert@gondor.apana.org.au Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id CC01C607D3 for ; Sat, 10 Sep 2016 03:43:03 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AC9FE29FB1 for ; Sat, 10 Sep 2016 03:43:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8F4FE29FB6; Sat, 10 Sep 2016 03:43:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8EBFE29FB1 for ; Sat, 10 Sep 2016 03:43:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752638AbcIJDnB (ORCPT ); Fri, 9 Sep 2016 23:43:01 -0400 Received: from mail.eperm.de ([89.247.134.16]:47910 "EHLO mail.eperm.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751537AbcIJDnB (ORCPT ); Fri, 9 Sep 2016 23:43:01 -0400 Received: from positron.chronox.de (rrcs-97-79-174-130.sw.biz.rr.com [97.79.174.130]) by mail.eperm.de (Postfix) with ESMTPA id 41CBA18149CA; Sat, 10 Sep 2016 05:42:57 +0200 (CEST) From: Stephan Mueller To: herbert@gondor.apana.org.au Cc: linux-crypto@vger.kernel.org Subject: [PATCH] crypto: only call put_page used pages Date: Sat, 10 Sep 2016 05:42:51 +0200 Message-ID: <2555546.QkgIzR2raW@positron.chronox.de> User-Agent: KMail/5.2.3 (Linux/4.7.2-201.fc24.x86_64; KDE/5.25.0; x86_64; ; ) In-Reply-To: <2637498.CLV37KecV5@positron.chronox.de> References: <2637498.CLV37KecV5@positron.chronox.de> MIME-Version: 1.0 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hi Herbert, This patch was tested with up to 64 iocb submitted with one io_submit call. If you approve of this fix, I recommend that should go to the current 4.8 development cycle and to stable. ---8<--- For asynchronous operation, SGs are allocated without a page mapped to them. If the SGL is freed, the code must only call put_page for an SG if there was a page assigned to it in the first place. This fixes a kernel crash when using io_submit with more than one iocb. Signed-off-by: Stephan Mueller --- crypto/algif_skcipher.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c index 28556fc..58ec57a 100644 --- a/crypto/algif_skcipher.c +++ b/crypto/algif_skcipher.c @@ -86,8 +86,13 @@ static void skcipher_free_async_sgls(struct skcipher_async_req *sreq) } sgl = sreq->tsg; n = sg_nents(sgl); - for_each_sg(sgl, sg, n, i) - put_page(sg_page(sg)); + for_each_sg(sgl, sg, n, i) { + struct page *page = sg_page(sg); + + /* some SGs may not have a page mapped */ + if (page_ref_count(page)) + put_page(sg_page(sg)); + } kfree(sreq->tsg); }