* Re: BUG: unable to handle kernel paging request in hmac_init_tfm [not found] <94eb2c0d010ad8f1660560a275fd@google.com> @ 2017-12-20 23:09 ` Eric Biggers 2017-12-21 7:44 ` Dmitry Vyukov 2017-12-20 23:42 ` Eric Biggers 2018-01-30 21:41 ` Eric Biggers 2 siblings, 1 reply; 6+ messages in thread From: Eric Biggers @ 2017-12-20 23:09 UTC (permalink / raw) To: syzbot; +Cc: davem, herbert, linux-crypto, linux-kernel, syzkaller-bugs On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached FYI, in linux-next KASAN and other memory debugging options are now behind CONFIG_DEBUG_MEMORY. So, I think KASAN isn't getting turned on anymore, despite the CONFIG_KASAN=y. (Patch was "lib/: make "Memory Debugging" a menuconfig to ease disabling it all".) Eric ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: BUG: unable to handle kernel paging request in hmac_init_tfm 2017-12-20 23:09 ` BUG: unable to handle kernel paging request in hmac_init_tfm Eric Biggers @ 2017-12-21 7:44 ` Dmitry Vyukov 2017-12-22 2:27 ` Eric Biggers 0 siblings, 1 reply; 6+ messages in thread From: Dmitry Vyukov @ 2017-12-21 7:44 UTC (permalink / raw) To: Eric Biggers Cc: syzbot, David Miller, Herbert Xu, linux-crypto, LKML, syzkaller-bugs On Thu, Dec 21, 2017 at 12:09 AM, Eric Biggers <ebiggers3@gmail.com> wrote: > On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote: >> Hello, >> >> syzkaller hit the following crash on >> 6084b576dca2e898f5c101baef151f7bfdbb606d >> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master >> compiler: gcc (GCC) 7.1.1 20170620 >> .config is attached > > FYI, in linux-next KASAN and other memory debugging options are now behind > CONFIG_DEBUG_MEMORY. So, I think KASAN isn't getting turned on anymore, despite > the CONFIG_KASAN=y. (Patch was "lib/: make "Memory Debugging" a menuconfig to > ease disabling it all".) Ouch! That would be pretty bad. But I've tried both linux-next HEAD at: commit 0e08c463db387a2adcb0243b15ab868a73f87807 (HEAD, tag: next-20171221, linux-next/master) Author: Stephen Rothwell <sfr@canb.auug.org.au> Date: Thu Dec 21 15:37:39 2017 +1100 Add linux-next specific files for 20171221 and mmots HEAD at: commit 75aa5540627fdb3d8f86229776ea87f995275351 (HEAD, tag: v4.15-rc4-mmots-2017-12-20-19-10, mmots/master) Author: Linus Torvalds <torvalds@linux-foundation.org> Date: Thu Dec 21 04:02:17 2017 +0000 pci: test for unexpectedly disabled bridges and after running make olddefconfig I still see CONFIG_KASAN=y in .config, nor I can find CONFIG_DEBUG_MEMORY in menuconfig. What am I missing? What commit has added the config? ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: BUG: unable to handle kernel paging request in hmac_init_tfm 2017-12-21 7:44 ` Dmitry Vyukov @ 2017-12-22 2:27 ` Eric Biggers 2017-12-22 9:01 ` Dmitry Vyukov 0 siblings, 1 reply; 6+ messages in thread From: Eric Biggers @ 2017-12-22 2:27 UTC (permalink / raw) To: Dmitry Vyukov Cc: syzbot, David Miller, Herbert Xu, linux-crypto, LKML, syzkaller-bugs On Thu, Dec 21, 2017 at 08:44:03AM +0100, 'Dmitry Vyukov' via syzkaller-bugs wrote: > On Thu, Dec 21, 2017 at 12:09 AM, Eric Biggers <ebiggers3@gmail.com> wrote: > > On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote: > >> Hello, > >> > >> syzkaller hit the following crash on > >> 6084b576dca2e898f5c101baef151f7bfdbb606d > >> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > >> compiler: gcc (GCC) 7.1.1 20170620 > >> .config is attached > > > > FYI, in linux-next KASAN and other memory debugging options are now behind > > CONFIG_DEBUG_MEMORY. So, I think KASAN isn't getting turned on anymore, despite > > the CONFIG_KASAN=y. (Patch was "lib/: make "Memory Debugging" a menuconfig to > > ease disabling it all".) > > Ouch! That would be pretty bad. > > But I've tried both linux-next HEAD at: > > commit 0e08c463db387a2adcb0243b15ab868a73f87807 (HEAD, tag: > next-20171221, linux-next/master) > Author: Stephen Rothwell <sfr@canb.auug.org.au> > Date: Thu Dec 21 15:37:39 2017 +1100 > Add linux-next specific files for 20171221 > > and mmots HEAD at: > > commit 75aa5540627fdb3d8f86229776ea87f995275351 (HEAD, tag: > v4.15-rc4-mmots-2017-12-20-19-10, mmots/master) > Author: Linus Torvalds <torvalds@linux-foundation.org> > Date: Thu Dec 21 04:02:17 2017 +0000 > pci: test for unexpectedly disabled bridges > > and after running make olddefconfig I still see CONFIG_KASAN=y in > .config, nor I can find CONFIG_DEBUG_MEMORY in menuconfig. > > What am I missing? What commit has added the config? > Ah, I see the patch was added to -mm on 2017-12-12 but removed two days later: https://www.spinics.net/lists/mm-commits/msg129685.html https://www.spinics.net/lists/mm-commits/msg129696.html So it was in linux-next temporarily (including the kernel version used for this particular bug report) but now it's not. Just keep an eye out for it coming back, I guess. Eric ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: BUG: unable to handle kernel paging request in hmac_init_tfm 2017-12-22 2:27 ` Eric Biggers @ 2017-12-22 9:01 ` Dmitry Vyukov 0 siblings, 0 replies; 6+ messages in thread From: Dmitry Vyukov @ 2017-12-22 9:01 UTC (permalink / raw) To: Eric Biggers Cc: syzbot, David Miller, Herbert Xu, linux-crypto, LKML, syzkaller-bugs On Fri, Dec 22, 2017 at 3:27 AM, Eric Biggers <ebiggers3@gmail.com> wrote: > On Thu, Dec 21, 2017 at 08:44:03AM +0100, 'Dmitry Vyukov' via syzkaller-bugs wrote: >> On Thu, Dec 21, 2017 at 12:09 AM, Eric Biggers <ebiggers3@gmail.com> wrote: >> > On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote: >> >> Hello, >> >> >> >> syzkaller hit the following crash on >> >> 6084b576dca2e898f5c101baef151f7bfdbb606d >> >> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master >> >> compiler: gcc (GCC) 7.1.1 20170620 >> >> .config is attached >> > >> > FYI, in linux-next KASAN and other memory debugging options are now behind >> > CONFIG_DEBUG_MEMORY. So, I think KASAN isn't getting turned on anymore, despite >> > the CONFIG_KASAN=y. (Patch was "lib/: make "Memory Debugging" a menuconfig to >> > ease disabling it all".) >> >> Ouch! That would be pretty bad. >> >> But I've tried both linux-next HEAD at: >> >> commit 0e08c463db387a2adcb0243b15ab868a73f87807 (HEAD, tag: >> next-20171221, linux-next/master) >> Author: Stephen Rothwell <sfr@canb.auug.org.au> >> Date: Thu Dec 21 15:37:39 2017 +1100 >> Add linux-next specific files for 20171221 >> >> and mmots HEAD at: >> >> commit 75aa5540627fdb3d8f86229776ea87f995275351 (HEAD, tag: >> v4.15-rc4-mmots-2017-12-20-19-10, mmots/master) >> Author: Linus Torvalds <torvalds@linux-foundation.org> >> Date: Thu Dec 21 04:02:17 2017 +0000 >> pci: test for unexpectedly disabled bridges >> >> and after running make olddefconfig I still see CONFIG_KASAN=y in >> .config, nor I can find CONFIG_DEBUG_MEMORY in menuconfig. >> >> What am I missing? What commit has added the config? >> > > Ah, I see the patch was added to -mm on 2017-12-12 but removed two days later: > > https://www.spinics.net/lists/mm-commits/msg129685.html > https://www.spinics.net/lists/mm-commits/msg129696.html > > So it was in linux-next temporarily (including the kernel version used for this > particular bug report) but now it's not. Just keep an eye out for it coming > back, I guess. I see. Then I will add CONFIG_DEBUG_MEMORY=y to our config proactively. Without that patch olddefconfig will just wipe that config, so should work. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: BUG: unable to handle kernel paging request in hmac_init_tfm [not found] <94eb2c0d010ad8f1660560a275fd@google.com> 2017-12-20 23:09 ` BUG: unable to handle kernel paging request in hmac_init_tfm Eric Biggers @ 2017-12-20 23:42 ` Eric Biggers 2018-01-30 21:41 ` Eric Biggers 2 siblings, 0 replies; 6+ messages in thread From: Eric Biggers @ 2017-12-20 23:42 UTC (permalink / raw) To: syzbot; +Cc: davem, herbert, linux-crypto, linux-kernel, syzkaller-bugs On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > > Unfortunately, I don't have any reproducer for this bug yet. > > > BUG: unable to handle kernel paging request at ffff8802dca4f748 > IP: hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169 > PGD 404e067 P4D 404e067 PUD 0 > Oops: 0002 [#1] SMP > Dumping ftrace buffer: > (ftrace buffer empty) > Modules linked in: > CPU: 1 PID: 6418 Comm: syz-executor5 Not tainted > 4.15.0-rc3-next-20171214+ #67 > Hardware name: Google Google Compute Engine/Google Compute Engine, > BIOS Google 01/01/2011 > RIP: 0010:hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169 > RSP: 0018:ffffc90000f77df8 EFLAGS: 00010202 > RAX: 0000000000000068 RBX: ffff8801dca52308 RCX: ffffffff816847d3 > RDX: 00000000000005d6 RSI: ffffc90004d7e000 RDI: ffff8802143cc708 > RBP: ffffc90000f77e10 R08: 000000000002bcf8 R09: ffff8802143cc700 > R10: 0000000000000000 R11: 0000000000000000 R12: ffff8802143cc700 > R13: ffff8802dca4f748 R14: ffff8801e0a96c50 R15: ffffc90000f77ed0 > FS: 00007fecf7c1a700(0000) GS:ffff88021fd00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: ffff8802dca4f748 CR3: 00000001e47f4000 CR4: 00000000001406e0 > DR0: 0000000020000008 DR1: 0000000020000008 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 > Call Trace: > crypto_create_tfm+0xb4/0x120 crypto/api.c:466 > crypto_alloc_tfm+0x82/0x180 crypto/api.c:540 > crypto_alloc_shash+0x2c/0x40 crypto/shash.c:436 > sctp_listen_start net/sctp/socket.c:7496 [inline] > sctp_inet_listen+0x1c1/0x240 net/sctp/socket.c:7584 > SYSC_listen net/socket.c:1483 [inline] > SyS_listen+0x71/0xb0 net/socket.c:1469 > entry_SYSCALL_64_fastpath+0x1f/0x96 > RIP: 0033:0x452a39 > RSP: 002b:00007fecf7c19c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000032 > RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452a39 > RDX: 0000000000000000 RSI: 0000000000000ae0 RDI: 000000000000001b > RBP: 00000000000000e8 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006ef660 > R13: 00000000ffffffff R14: 00007fecf7c1a6d4 R15: 0000000000000000 > Code: ff 01 c0 4c 8d 6c 02 07 e8 a1 22 ff ff 49 83 e5 f8 48 3d 00 f0 > ff ff 49 89 c4 77 25 e8 6d 5b c3 ff 41 8b 04 24 83 c0 10 89 43 f8 > <4d> 89 65 00 45 31 e4 e8 57 5b c3 ff 44 89 e0 5b 41 5c 41 5d 5d > RIP: hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169 RSP: ffffc90000f77df8 > CR2: ffff8802dca4f748 > ---[ end trace ec6d3df7509d0a3b ]--- > Kernel panic - not syncing: Fatal exception > Dumping ftrace buffer: > (ftrace buffer empty) > Kernel Offset: disabled > Rebooting in 86400 seconds.. The crash was actually on the line 'ctx->hash = hash;' in hmac_init_tfm(): static int hmac_init_tfm(struct crypto_tfm *tfm) { struct crypto_shash *parent = __crypto_shash_cast(tfm); struct crypto_shash *hash; struct crypto_instance *inst = (void *)tfm->__crt_alg; struct crypto_shash_spawn *spawn = crypto_instance_ctx(inst); struct hmac_ctx *ctx = hmac_ctx(parent); hash = crypto_spawn_shash(spawn); if (IS_ERR(hash)) return PTR_ERR(hash); parent->descsize = sizeof(struct shash_desc) + crypto_shash_descsize(hash); ctx->hash = hash; return 0; } 'parent' was ffff8801dca52308 in RBX while 'ctx' was ffff8802dca4f748 in R13. They are supposed to be almost the same but were actually quite different, so I think the ->statesize and/or the ->cra_alignmask in the shash_alg got corrupted, causing hmac_ctx() to return the wrong value. I am guessing use-after-free, so the report would have been more useful with KASAN enabled. Eric ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: BUG: unable to handle kernel paging request in hmac_init_tfm [not found] <94eb2c0d010ad8f1660560a275fd@google.com> 2017-12-20 23:09 ` BUG: unable to handle kernel paging request in hmac_init_tfm Eric Biggers 2017-12-20 23:42 ` Eric Biggers @ 2018-01-30 21:41 ` Eric Biggers 2 siblings, 0 replies; 6+ messages in thread From: Eric Biggers @ 2018-01-30 21:41 UTC (permalink / raw) To: syzbot; +Cc: davem, herbert, linux-crypto, linux-kernel, syzkaller-bugs On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > > Unfortunately, I don't have any reproducer for this bug yet. > > > BUG: unable to handle kernel paging request at ffff8802dca4f748 > IP: hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169 > PGD 404e067 P4D 404e067 PUD 0 > Oops: 0002 [#1] SMP > Dumping ftrace buffer: > (ftrace buffer empty) > Modules linked in: > CPU: 1 PID: 6418 Comm: syz-executor5 Not tainted 4.15.0-rc3-next-20171214+ > #67 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > RIP: 0010:hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169 > RSP: 0018:ffffc90000f77df8 EFLAGS: 00010202 > RAX: 0000000000000068 RBX: ffff8801dca52308 RCX: ffffffff816847d3 > RDX: 00000000000005d6 RSI: ffffc90004d7e000 RDI: ffff8802143cc708 > RBP: ffffc90000f77e10 R08: 000000000002bcf8 R09: ffff8802143cc700 > R10: 0000000000000000 R11: 0000000000000000 R12: ffff8802143cc700 > R13: ffff8802dca4f748 R14: ffff8801e0a96c50 R15: ffffc90000f77ed0 > FS: 00007fecf7c1a700(0000) GS:ffff88021fd00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: ffff8802dca4f748 CR3: 00000001e47f4000 CR4: 00000000001406e0 > DR0: 0000000020000008 DR1: 0000000020000008 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 > Call Trace: > crypto_create_tfm+0xb4/0x120 crypto/api.c:466 > crypto_alloc_tfm+0x82/0x180 crypto/api.c:540 > crypto_alloc_shash+0x2c/0x40 crypto/shash.c:436 > sctp_listen_start net/sctp/socket.c:7496 [inline] > sctp_inet_listen+0x1c1/0x240 net/sctp/socket.c:7584 > SYSC_listen net/socket.c:1483 [inline] > SyS_listen+0x71/0xb0 net/socket.c:1469 > entry_SYSCALL_64_fastpath+0x1f/0x96 > RIP: 0033:0x452a39 > RSP: 002b:00007fecf7c19c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000032 > RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452a39 > RDX: 0000000000000000 RSI: 0000000000000ae0 RDI: 000000000000001b > RBP: 00000000000000e8 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006ef660 > R13: 00000000ffffffff R14: 00007fecf7c1a6d4 R15: 0000000000000000 > Code: ff 01 c0 4c 8d 6c 02 07 e8 a1 22 ff ff 49 83 e5 f8 48 3d 00 f0 ff ff > 49 89 c4 77 25 e8 6d 5b c3 ff 41 8b 04 24 83 c0 10 89 43 f8 <4d> 89 65 00 45 > 31 e4 e8 57 5b c3 ff 44 89 e0 5b 41 5c 41 5d 5d > RIP: hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169 RSP: ffffc90000f77df8 > CR2: ffff8802dca4f748 > ---[ end trace ec6d3df7509d0a3b ]--- > Kernel panic - not syncing: Fatal exception > Dumping ftrace buffer: > (ftrace buffer empty) > Kernel Offset: disabled > Rebooting in 86400 seconds.. Invalidating this bug since it hasn't been seen again, and it was reported while KASAN was accidentally disabled in the syzbot config due to a change to the kconfig menus in linux-next (so this crash was probably caused by slab corruption elsewhere). #syz invalid ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2018-01-30 21:41 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <94eb2c0d010ad8f1660560a275fd@google.com>
2017-12-20 23:09 ` BUG: unable to handle kernel paging request in hmac_init_tfm Eric Biggers
2017-12-21 7:44 ` Dmitry Vyukov
2017-12-22 2:27 ` Eric Biggers
2017-12-22 9:01 ` Dmitry Vyukov
2017-12-20 23:42 ` Eric Biggers
2018-01-30 21:41 ` Eric Biggers
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).