From: Eric Biggers <ebiggers3@gmail.com>
To: syzbot
<bot+5ac9d43b97a33f321ed58e24960e30defaef843f@syzkaller.appspotmail.com>
Cc: syzkaller-bugs@googlegroups.com, linux-crypto@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: BUG: unable to handle kernel NULL pointer dereference in sha512_mb_mgr_get_comp_job_avx2
Date: Mon, 12 Feb 2018 10:21:05 -0800 [thread overview]
Message-ID: <20180212182105.GA193902@gmail.com> (raw)
In-Reply-To: <001a113fae28e4fe39055f757ab5@google.com>
On Sun, Dec 03, 2017 at 12:31:01PM -0800, syzbot wrote:
> syzkaller has found reproducer for the following crash on
> 4131d5166185d0d75b5f1d4bf362a9e0bac05598
> git://git.cmpxchg.org/linux-mmots.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
>
> syzkaller reproducer is attached. See https://goo.gl/kgGztJ
> for information about syzkaller reproducers
>
>
> BUG: unable to handle kernel NULL pointer dereference at 00000000c58b0b19
> IP: sha512_mb_mgr_get_comp_job_avx2+0x6e/0xee
> arch/x86/crypto/sha512-mb/sha512_mb_mgr_flush_avx2.S:251
> PGD 1cb562067 P4D 1cb562067 PUD 1cb563067 PMD 0
> Oops: 0002 [#1] SMP KASAN
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Modules linked in:
> CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 4.15.0-rc1-mm1+ #29
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Workqueue: crypto mcryptd_queue_worker
> task: 0000000018ff7174 task.stack: 000000004c6e7fb4
> RIP: 0010:sha512_mb_mgr_get_comp_job_avx2+0x6e/0xee
> arch/x86/crypto/sha512-mb/sha512_mb_mgr_flush_avx2.S:251
> RSP: 0018:ffff8801d9d171b8 EFLAGS: 00010002
> RAX: 0000000000000000 RBX: ffff8801d5aa38d0 RCX: 0000000000000000
> RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8801d5aa3780
> RBP: ffff8801d9d171e0 R08: 0000000100000000 R09: 0000000000000001
> R10: 0000000000000002 R11: 0000000000000003 R12: ffff8801d5aa3780
> R13: 0000000000000282 R14: ffff8801cc115760 R15: ffffe8ffffd10630
> FS: 0000000000000000(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000060 CR3: 00000001cb55f000 CR4: 00000000001406e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> sha_complete_job+0x276/0x830 arch/x86/crypto/sha512-mb/sha512_mb.c:510
> sha512_mb_update+0x2f6/0x530 arch/x86/crypto/sha512-mb/sha512_mb.c:610
> crypto_ahash_update include/crypto/hash.h:522 [inline]
> ahash_mcryptd_update crypto/mcryptd.c:628 [inline]
> mcryptd_hash_update+0xcd/0x1c0 crypto/mcryptd.c:374
> mcryptd_queue_worker+0xfe/0x660 crypto/mcryptd.c:182
> process_one_work+0xbfd/0x1bc0 kernel/workqueue.c:2113
> worker_thread+0x223/0x1990 kernel/workqueue.c:2247
> kthread+0x37a/0x440 kernel/kthread.c:238
> ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:517
> Code: 49 0f 42 d3 48 f7 c2 f0 ff ff ff 0f 85 9a 00 00 00 48 83 e2 0f 48 6b
> da 08 48 8d 9c 1f 48 01 00 00 48 8b 03 48 c7 03 00 00 00 00 <c7> 40 60 02 00
> 00 00 48 8b 9f 40 01 00 00 48 c1 e3 08 48 09 d3
> RIP: sha512_mb_mgr_get_comp_job_avx2+0x6e/0xee
> arch/x86/crypto/sha512-mb/sha512_mb_mgr_flush_avx2.S:251 RSP:
> ffff8801d9d171b8
> CR2: 0000000000000060
> ---[ end trace 2003a6fbb2bb168e ]---
> Kernel panic - not syncing: Fatal exception
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Kernel Offset: disabled
> Rebooting in 86400 seconds..
Fixed by commit eff84b379089cd, so marking it fixed for syzbot:
#syz fix: crypto: sha512-mb - initialize pending lengths correctly
- Eric
prev parent reply other threads:[~2018-02-12 18:21 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <001a113ec900d65ea5055f70560f@google.com>
2017-12-03 20:31 ` BUG: unable to handle kernel NULL pointer dereference in sha512_mb_mgr_get_comp_job_avx2 syzbot
2018-01-24 8:31 ` [PATCH] crypto: sha512-mb - initialize pending lengths correctly Eric Biggers
2018-02-09 15:48 ` Herbert Xu
2018-02-12 18:21 ` Eric Biggers [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180212182105.GA193902@gmail.com \
--to=ebiggers3@gmail.com \
--cc=bot+5ac9d43b97a33f321ed58e24960e30defaef843f@syzkaller.appspotmail.com \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).