aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDaniel Jordan <daniel.m.jordan@oracle.com>2020-02-14 13:28:21 -0500
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-02-14 16:33:28 -0500
commitcad926f70b5a3ac61de0274c28891dc7fbd8d2ad (patch)
tree8302c1a7d8e015c286ddb8ef031044ee3c65b18d
parent77bad0ab1b725e6c348277fcdb8790908286ca20 (diff)
downloadlinux-yocto-cad926f70b5a3ac61de0274c28891dc7fbd8d2ad.tar.gz
linux-yocto-cad926f70b5a3ac61de0274c28891dc7fbd8d2ad.tar.bz2
linux-yocto-cad926f70b5a3ac61de0274c28891dc7fbd8d2ad.zip
padata: fix null pointer deref of pd->pinst
The 4.19 backport dc34710a7aba ("padata: Remove broken queue flushing") removed padata_alloc_pd()'s assignment to pd->pinst, resulting in: Unable to handle kernel NULL pointer dereference ... ... pc : padata_reorder+0x144/0x2e0 ... Call trace: padata_reorder+0x144/0x2e0 padata_do_serial+0xc8/0x128 pcrypt_aead_enc+0x60/0x70 [pcrypt] padata_parallel_worker+0xd8/0x138 process_one_work+0x1bc/0x4b8 worker_thread+0x164/0x580 kthread+0x134/0x138 ret_from_fork+0x10/0x18 This happened because the backport was based on an enhancement that moved this assignment but isn't in 4.19: bfde23ce200e ("padata: unbind parallel jobs from specific CPUs") Simply restore the assignment to fix the crash. Fixes: dc34710a7aba ("padata: Remove broken queue flushing") Reported-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Herbert Xu <herbert@gondor.apana.org.au> Cc: Sasha Levin <sashal@kernel.org> Cc: Steffen Klassert <steffen.klassert@secunet.com> Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--kernel/padata.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/kernel/padata.c b/kernel/padata.c
index 11c5f9c8779e..cfab62923c45 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -510,6 +510,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,
atomic_set(&pd->seq_nr, -1);
atomic_set(&pd->reorder_objects, 0);
atomic_set(&pd->refcnt, 1);
+ pd->pinst = pinst;
spin_lock_init(&pd->lock);
return pd;