From: Mikulas Patocka Date: Wed, 22 Aug 2018 16:45:51 +0000 (-0400) Subject: dm verity: fix crash on bufio buffer that was allocated with vmalloc X-Git-Tag: MMI-QSB30.62-17~983^2~44^2~30 X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=0be812a800391c6d9447ed15b4bedb63b941b5aa;p=GitHub%2FMotorolaMobilityLLC%2Fkernel-slsi.git dm verity: fix crash on bufio buffer that was allocated with vmalloc commit e4b069e0945fa14c71cf8b5b89f8b1b2aa68dbc2 upstream. Since commit d1ac3ff008fb ("dm verity: switch to using asynchronous hash crypto API") dm-verity uses asynchronous crypto calls for verification, so that it can use hardware with asynchronous processing of crypto operations. These asynchronous calls don't support vmalloc memory, but the buffer data can be allocated with vmalloc if dm-bufio is short of memory and uses a reserved buffer that was preallocated in dm_bufio_client_create(). Fix verity_hash_update() so that it deals with vmalloc'd memory correctly. Reported-by: "Xiao, Jin" Signed-off-by: Mikulas Patocka Fixes: d1ac3ff008fb ("dm verity: switch to using asynchronous hash crypto API") Cc: stable@vger.kernel.org # 4.12+ Signed-off-by: Mike Snitzer Signed-off-by: Sudip Mukherjee Acked-by: Mikulas Patocka Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c index bda3caca23ca..8573c70a1880 100644 --- a/drivers/md/dm-verity-target.c +++ b/drivers/md/dm-verity-target.c @@ -139,10 +139,26 @@ static int verity_hash_update(struct dm_verity *v, struct ahash_request *req, { struct scatterlist sg; - sg_init_one(&sg, data, len); - ahash_request_set_crypt(req, &sg, NULL, len); - - return verity_complete_op(res, crypto_ahash_update(req)); + if (likely(!is_vmalloc_addr(data))) { + sg_init_one(&sg, data, len); + ahash_request_set_crypt(req, &sg, NULL, len); + return verity_complete_op(res, crypto_ahash_update(req)); + } else { + do { + int r; + size_t this_step = min_t(size_t, len, PAGE_SIZE - offset_in_page(data)); + flush_kernel_vmap_range((void *)data, this_step); + sg_init_table(&sg, 1); + sg_set_page(&sg, vmalloc_to_page(data), this_step, offset_in_page(data)); + ahash_request_set_crypt(req, &sg, NULL, this_step); + r = verity_complete_op(res, crypto_ahash_update(req)); + if (unlikely(r)) + return r; + data += this_step; + len -= this_step; + } while (len); + return 0; + } } /*