From: Eric Biggers ebiggers@google.com
commit 77251e41f89a813b4090f5199442f217bbf11297 upstream.
When a crypto template needs to be instantiated, CRYPTO_MSG_ALG_REQUEST is sent to crypto_chain. cryptomgr_schedule_probe() handles this by starting a thread to instantiate the template, then waiting for this thread to complete via crypto_larval::completion.
This can deadlock because instantiating the template may require loading modules, and this (apparently depending on userspace) may need to wait for the crc-t10dif module (lib/crc-t10dif.c) to be loaded. But crc-t10dif's module_init function uses crypto_register_notifier() and therefore takes crypto_chain.rwsem for write. That can't proceed until the notifier callback has finished, as it holds this semaphore for read.
Fix this by removing the wait on crypto_larval::completion from within cryptomgr_schedule_probe(). It's actually unnecessary because crypto_alg_mod_lookup() calls crypto_larval_wait() itself after sending CRYPTO_MSG_ALG_REQUEST.
This only actually became a problem in v4.20 due to commit b76377543b73 ("crc-t10dif: Pick better transform if one becomes available"), but the unnecessary wait was much older.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207159 Reported-by: Mike Gerow gerow@google.com Fixes: 398710379f51 ("crypto: algapi - Move larval completion into algboss") Cc: stable@vger.kernel.org # v3.6+ Cc: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Eric Biggers ebiggers@google.com Reported-by: Kai Lüke kai@kinvolk.io Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- crypto/algboss.c | 2 -- 1 file changed, 2 deletions(-)
--- a/crypto/algboss.c +++ b/crypto/algboss.c @@ -193,8 +193,6 @@ static int cryptomgr_schedule_probe(stru if (IS_ERR(thread)) goto err_put_larval;
- wait_for_completion_interruptible(&larval->completion); - return NOTIFY_STOP;
err_put_larval: