From cad926f70b5a3ac61de0274c28891dc7fbd8d2ad Mon Sep 17 00:00:00 2001 From: Daniel Jordan Date: Fri, 14 Feb 2020 13:28:21 -0500 Subject: [PATCH] padata: fix null pointer deref of pd->pinst The 4.19 backport dc34710a7aba ("padata: Remove broken queue flushing") removed padata_alloc_pd()'s assignment to pd->pinst, resulting in: Unable to handle kernel NULL pointer dereference ... ... pc : padata_reorder+0x144/0x2e0 ... Call trace: padata_reorder+0x144/0x2e0 padata_do_serial+0xc8/0x128 pcrypt_aead_enc+0x60/0x70 [pcrypt] padata_parallel_worker+0xd8/0x138 process_one_work+0x1bc/0x4b8 worker_thread+0x164/0x580 kthread+0x134/0x138 ret_from_fork+0x10/0x18 This happened because the backport was based on an enhancement that moved this assignment but isn't in 4.19: bfde23ce200e ("padata: unbind parallel jobs from specific CPUs") Simply restore the assignment to fix the crash. Fixes: dc34710a7aba ("padata: Remove broken queue flushing") Reported-by: Yang Yingliang Signed-off-by: Daniel Jordan Cc: Greg Kroah-Hartman Cc: Herbert Xu Cc: Sasha Levin Cc: Steffen Klassert Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- kernel/padata.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/padata.c b/kernel/padata.c index 11c5f9c..cfab629 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -510,6 +510,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst, atomic_set(&pd->seq_nr, -1); atomic_set(&pd->reorder_objects, 0); atomic_set(&pd->refcnt, 1); + pd->pinst = pinst; spin_lock_init(&pd->lock); return pd; -- 2.7.4