The patch below does not apply to the 5.4-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y git checkout FETCH_HEAD git cherry-pick -x 9a22b2812393d93d84358a760c347c21939029a6 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to 'stable@vger.kernel.org' --in-reply-to '2024100110-smokiness-detract-b410@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
9a22b2812393 ("padata: use integer wrap around to prevent deadlock on seq_nr overflow") 57ddfecc72a6 ("padata: Fix list iterator in padata_do_serial()") f601c725a6ac ("padata: remove padata_parallel_queue") 4611ce224688 ("padata: allocate work structures for parallel jobs from a pool") f1b192b117cd ("padata: initialize earlier") 305dacf77952 ("padata: remove exit routine") bfcdcef8c8e3 ("padata: update documentation") 3facced7aeed ("padata: remove reorder_objects") 91a71d612128 ("padata: remove cpumask change notifier") 894c9ef9780c ("padata: validate cpumask without removed CPU during offline") bbefa1dd6a6d ("crypto: pcrypt - Avoid deadlock by using per-instance padata queues") 07928d9bfc81 ("padata: Remove broken queue flushing")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 9a22b2812393d93d84358a760c347c21939029a6 Mon Sep 17 00:00:00 2001 From: VanGiang Nguyen vangiang.nguyen@rohde-schwarz.com Date: Fri, 9 Aug 2024 06:21:42 +0000 Subject: [PATCH] padata: use integer wrap around to prevent deadlock on seq_nr overflow
When submitting more than 2^32 padata objects to padata_do_serial, the current sorting implementation incorrectly sorts padata objects with overflowed seq_nr, causing them to be placed before existing objects in the reorder list. This leads to a deadlock in the serialization process as padata_find_next cannot match padata->seq_nr and pd->processed because the padata instance with overflowed seq_nr will be selected next.
To fix this, we use an unsigned integer wrap around to correctly sort padata objects in scenarios with integer overflow.
Fixes: bfde23ce200e ("padata: unbind parallel jobs from specific CPUs") Cc: stable@vger.kernel.org Co-developed-by: Christian Gafert christian.gafert@rohde-schwarz.com Signed-off-by: Christian Gafert christian.gafert@rohde-schwarz.com Co-developed-by: Max Ferger max.ferger@rohde-schwarz.com Signed-off-by: Max Ferger max.ferger@rohde-schwarz.com Signed-off-by: Van Giang Nguyen vangiang.nguyen@rohde-schwarz.com Acked-by: Daniel Jordan daniel.m.jordan@oracle.com Signed-off-by: Herbert Xu herbert@gondor.apana.org.au
diff --git a/kernel/padata.c b/kernel/padata.c index 53f4bc912712..222bccd0c96b 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -404,7 +404,8 @@ void padata_do_serial(struct padata_priv *padata) /* Sort in ascending order of sequence number. */ list_for_each_prev(pos, &reorder->list) { cur = list_entry(pos, struct padata_priv, list); - if (cur->seq_nr < padata->seq_nr) + /* Compare by difference to consider integer wrap around */ + if ((signed int)(cur->seq_nr - padata->seq_nr) < 0) break; } list_add(&padata->list, pos);