From: Eric Biggers ebiggers@google.com
When a crypto template needs to be instantiated, CRYPTO_MSG_ALG_REQUEST is sent to crypto_chain. cryptomgr_schedule_probe() handles this by starting a thread to instantiate the template, then waiting for this thread to complete via crypto_larval::completion.
This can deadlock because instantiating the template may require loading modules, and this (apparently depending on userspace) may need to wait for the crc-t10dif module (lib/crc-t10dif.c) to be loaded. But crc-t10dif's module_init function uses crypto_register_notifier() and therefore takes crypto_chain.rwsem for write. That can't proceed until the notifier callback has finished, as it holds this semaphore for read.
Fix this by removing the wait on crypto_larval::completion from within cryptomgr_schedule_probe(). It's actually unnecessary because crypto_alg_mod_lookup() calls crypto_larval_wait() itself after sending CRYPTO_MSG_ALG_REQUEST.
This only actually became a problem in v4.20 due to commit b76377543b73 ("crc-t10dif: Pick better transform if one becomes available"), but the unnecessary wait was much older.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207159 Reported-by: Mike Gerow gerow@google.com Fixes: 398710379f51 ("crypto: algapi - Move larval completion into algboss") Cc: stable@vger.kernel.org # v3.6+ Cc: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Eric Biggers ebiggers@google.com --- crypto/algboss.c | 2 -- 1 file changed, 2 deletions(-)
diff --git a/crypto/algboss.c b/crypto/algboss.c index 535f1f87e6c1..5ebccbd6b74e 100644 --- a/crypto/algboss.c +++ b/crypto/algboss.c @@ -178,8 +178,6 @@ static int cryptomgr_schedule_probe(struct crypto_larval *larval) if (IS_ERR(thread)) goto err_put_larval;
- wait_for_completion_interruptible(&larval->completion); - return NOTIFY_STOP;
err_put_larval:
On Thu, Jun 04, 2020 at 11:52:53AM -0700, Eric Biggers wrote:
From: Eric Biggers ebiggers@google.com
When a crypto template needs to be instantiated, CRYPTO_MSG_ALG_REQUEST is sent to crypto_chain. cryptomgr_schedule_probe() handles this by starting a thread to instantiate the template, then waiting for this thread to complete via crypto_larval::completion.
This can deadlock because instantiating the template may require loading modules, and this (apparently depending on userspace) may need to wait for the crc-t10dif module (lib/crc-t10dif.c) to be loaded. But crc-t10dif's module_init function uses crypto_register_notifier() and therefore takes crypto_chain.rwsem for write. That can't proceed until the notifier callback has finished, as it holds this semaphore for read.
Fix this by removing the wait on crypto_larval::completion from within cryptomgr_schedule_probe(). It's actually unnecessary because crypto_alg_mod_lookup() calls crypto_larval_wait() itself after sending CRYPTO_MSG_ALG_REQUEST.
This only actually became a problem in v4.20 due to commit b76377543b73 ("crc-t10dif: Pick better transform if one becomes available"), but the unnecessary wait was much older.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207159 Reported-by: Mike Gerow gerow@google.com
I forgot about the person who originally filed the bugzilla bug. Kai, if you're okay with it, let's also add:
Reported-by: Kai Lüke kai@kinvolk.io
Fixes: 398710379f51 ("crypto: algapi - Move larval completion into algboss") Cc: stable@vger.kernel.org # v3.6+ Cc: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Eric Biggers ebiggers@google.com
crypto/algboss.c | 2 -- 1 file changed, 2 deletions(-)
diff --git a/crypto/algboss.c b/crypto/algboss.c index 535f1f87e6c1..5ebccbd6b74e 100644 --- a/crypto/algboss.c +++ b/crypto/algboss.c @@ -178,8 +178,6 @@ static int cryptomgr_schedule_probe(struct crypto_larval *larval) if (IS_ERR(thread)) goto err_put_larval;
- wait_for_completion_interruptible(&larval->completion);
- return NOTIFY_STOP;
err_put_larval: -- 2.27.0.rc2.251.g90737beb825-goog
On Thu, Jun 04, 2020 at 11:52:53AM -0700, Eric Biggers wrote:
From: Eric Biggers ebiggers@google.com
When a crypto template needs to be instantiated, CRYPTO_MSG_ALG_REQUEST is sent to crypto_chain. cryptomgr_schedule_probe() handles this by starting a thread to instantiate the template, then waiting for this thread to complete via crypto_larval::completion.
This can deadlock because instantiating the template may require loading modules, and this (apparently depending on userspace) may need to wait for the crc-t10dif module (lib/crc-t10dif.c) to be loaded. But crc-t10dif's module_init function uses crypto_register_notifier() and therefore takes crypto_chain.rwsem for write. That can't proceed until the notifier callback has finished, as it holds this semaphore for read.
Fix this by removing the wait on crypto_larval::completion from within cryptomgr_schedule_probe(). It's actually unnecessary because crypto_alg_mod_lookup() calls crypto_larval_wait() itself after sending CRYPTO_MSG_ALG_REQUEST.
This only actually became a problem in v4.20 due to commit b76377543b73 ("crc-t10dif: Pick better transform if one becomes available"), but the unnecessary wait was much older.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207159 Reported-by: Mike Gerow gerow@google.com Fixes: 398710379f51 ("crypto: algapi - Move larval completion into algboss") Cc: stable@vger.kernel.org # v3.6+ Cc: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Eric Biggers ebiggers@google.com
crypto/algboss.c | 2 -- 1 file changed, 2 deletions(-)
Patch applied. Thanks.
linux-stable-mirror@lists.linaro.org
-
Eric Biggers -
Herbert Xu