mirror of
https://github.com/torvalds/linux.git
synced 2024-11-21 19:46:16 +00:00
e7a4142b35
On Fri, Aug 30, 2024 at 10:51:54AM -0700, Eric Biggers wrote:
>
> Given below in defconfig form, use 'make olddefconfig' to apply. The failures
> are nondeterministic and sometimes there are different ones, for example:
>
> [ 0.358017] alg: skcipher: failed to allocate transform for cbc(twofish-generic): -2
> [ 0.358365] alg: self-tests for cbc(twofish) using cbc(twofish-generic) failed (rc=-2)
> [ 0.358535] alg: skcipher: failed to allocate transform for cbc(camellia-generic): -2
> [ 0.358918] alg: self-tests for cbc(camellia) using cbc(camellia-generic) failed (rc=-2)
> [ 0.371533] alg: skcipher: failed to allocate transform for xts(ecb(aes-generic)): -2
> [ 0.371922] alg: self-tests for xts(aes) using xts(ecb(aes-generic)) failed (rc=-2)
>
> Modules are not enabled, maybe that matters (I haven't checked yet).
Yes I think that was the key. This triggers a massive self-test
run which executes in parallel and reveals a few race conditions
in the system. I think it boils down to the following scenario:
Base algorithm X-generic, X-optimised
Template Y
Optimised algorithm Y-X-optimised
Everything gets registered, and then the self-tests are started.
When Y-X-optimised gets tested, it requests the creation of the
generic Y(X-generic). Which then itself undergoes testing.
The race is that after Y(X-generic) gets registered, but just
before it gets tested, X-optimised finally finishes self-testing
which then causes all spawns of X-generic to be destroyed. So
by the time the self-test for Y(X-generic) comes along, it can
no longer find the algorithm. This error then bubbles up all
the way up to the self-test of Y-X-optimised which then fails.
Note that there is some complexity that I've omitted here because
when the generic self-test fails to find Y(X-generic) it actually
triggers the construction of it again which then fails for various
other reasons (these are not important because the construction
should *not* be triggered at this point).
So in a way the error is expected, and we should probably remove
the pr_err for the case where ENOENT is returned for the algorithm
that we're currently testing.
The solution is two-fold. First when an algorithm undergoes
self-testing it should not trigger its construction. Secondly
if an instance larval fails to materialise due to it being destroyed
by a more optimised algorithm coming along, it should obviously
retry the construction.
Remove the check in __crypto_alg_lookup that stops a larval from
matching new requests based on differences in the mask. It is better
to block new requests even if it is wrong and then simply retry the
lookup. If this ends up being the wrong larval it will sort iself
out during the retry.
Reduce the CRYPTO_ALG_TYPE_MASK bits in type during larval creation
as otherwise LSKCIPHER algorithms may not match SKCIPHER larvals.
Also block the instance creation during self-testing in the function
crypto_larval_lookup by checking for CRYPTO_ALG_TESTED in the mask
field.
Finally change the return value when crypto_alg_lookup fails in
crypto_larval_wait to EAGAIN to redo the lookup.
Fixes:
|
||
|---|---|---|
| .. | ||
| asymmetric_keys | ||
| async_tx | ||
| 842.c | ||
| acompress.c | ||
| adiantum.c | ||
| aead.c | ||
| aegis128-core.c | ||
| aegis128-neon-inner.c | ||
| aegis128-neon.c | ||
| aegis-neon.h | ||
| aegis.h | ||
| aes_generic.c | ||
| aes_ti.c | ||
| af_alg.c | ||
| ahash.c | ||
| akcipher.c | ||
| algapi.c | ||
| algboss.c | ||
| algif_aead.c | ||
| algif_hash.c | ||
| algif_rng.c | ||
| algif_skcipher.c | ||
| ansi_cprng.c | ||
| anubis.c | ||
| api.c | ||
| arc4.c | ||
| aria_generic.c | ||
| authenc.c | ||
| authencesn.c | ||
| blake2b_generic.c | ||
| blowfish_common.c | ||
| blowfish_generic.c | ||
| bpf_crypto_skcipher.c | ||
| camellia_generic.c | ||
| cast5_generic.c | ||
| cast6_generic.c | ||
| cast_common.c | ||
| cbc.c | ||
| ccm.c | ||
| chacha20poly1305.c | ||
| chacha_generic.c | ||
| cipher.c | ||
| cmac.c | ||
| compress.c | ||
| compress.h | ||
| crc32_generic.c | ||
| crc32c_generic.c | ||
| crc64_rocksoft_generic.c | ||
| crct10dif_common.c | ||
| crct10dif_generic.c | ||
| cryptd.c | ||
| crypto_engine.c | ||
| crypto_null.c | ||
| crypto_user.c | ||
| ctr.c | ||
| cts.c | ||
| curve25519-generic.c | ||
| deflate.c | ||
| des_generic.c | ||
| dh_helper.c | ||
| dh.c | ||
| drbg.c | ||
| ecb.c | ||
| ecc_curve_defs.h | ||
| ecc.c | ||
| ecdh_helper.c | ||
| ecdh.c | ||
| ecdsa.c | ||
| ecdsasignature.asn1 | ||
| echainiv.c | ||
| ecrdsa_defs.h | ||
| ecrdsa_params.asn1 | ||
| ecrdsa_pub_key.asn1 | ||
| ecrdsa.c | ||
| essiv.c | ||
| fcrypt.c | ||
| fips.c | ||
| gcm.c | ||
| geniv.c | ||
| ghash-generic.c | ||
| hash_info.c | ||
| hash.h | ||
| hctr2.c | ||
| hmac.c | ||
| internal.h | ||
| jitterentropy-kcapi.c | ||
| jitterentropy-testing.c | ||
| jitterentropy.c | ||
| jitterentropy.h | ||
| Kconfig | ||
| kdf_sp800108.c | ||
| keywrap.c | ||
| khazad.c | ||
| kpp.c | ||
| lrw.c | ||
| lskcipher.c | ||
| lz4.c | ||
| lz4hc.c | ||
| lzo-rle.c | ||
| lzo.c | ||
| Makefile | ||
| md4.c | ||
| md5.c | ||
| michael_mic.c | ||
| nhpoly1305.c | ||
| pcbc.c | ||
| pcrypt.c | ||
| poly1305_generic.c | ||
| polyval-generic.c | ||
| proc.c | ||
| ripemd.h | ||
| rmd160.c | ||
| rng.c | ||
| rsa_helper.c | ||
| rsa-pkcs1pad.c | ||
| rsa.c | ||
| rsaprivkey.asn1 | ||
| rsapubkey.asn1 | ||
| scatterwalk.c | ||
| scompress.c | ||
| seed.c | ||
| seqiv.c | ||
| serpent_generic.c | ||
| sha1_generic.c | ||
| sha3_generic.c | ||
| sha256_generic.c | ||
| sha512_generic.c | ||
| shash.c | ||
| sig.c | ||
| simd.c | ||
| skcipher.c | ||
| skcipher.h | ||
| sm3_generic.c | ||
| sm3.c | ||
| sm4_generic.c | ||
| sm4.c | ||
| streebog_generic.c | ||
| tcrypt.c | ||
| tcrypt.h | ||
| tea.c | ||
| testmgr.c | ||
| testmgr.h | ||
| twofish_common.c | ||
| twofish_generic.c | ||
| vmac.c | ||
| wp512.c | ||
| xcbc.c | ||
| xctr.c | ||
| xor.c | ||
| xts.c | ||
| xxhash_generic.c | ||
| zstd.c | ||