Re: BUG: unable to handle kernel paging request in hmac_init_tfm

2018-01-30 Thread Eric Biggers 
On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote:
> Hello,
> 
> syzkaller hit the following crash on
> 6084b576dca2e898f5c101baef151f7bfdbb606d
> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
> 
> Unfortunately, I don't have any reproducer for this bug yet.
> 
> 
> BUG: unable to handle kernel paging request at 8802dca4f748
> IP: hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169
> PGD 404e067 P4D 404e067 PUD 0
> Oops: 0002 [#1] SMP
> Dumping ftrace buffer:
>(ftrace buffer empty)
> Modules linked in:
> CPU: 1 PID: 6418 Comm: syz-executor5 Not tainted 4.15.0-rc3-next-20171214+
> #67
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> RIP: 0010:hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169
> RSP: 0018:c9f77df8 EFLAGS: 00010202
> RAX: 0068 RBX: 8801dca52308 RCX: 816847d3
> RDX: 05d6 RSI: c90004d7e000 RDI: 8802143cc708
> RBP: c9f77e10 R08: 0002bcf8 R09: 8802143cc700
> R10:  R11:  R12: 8802143cc700
> R13: 8802dca4f748 R14: 8801e0a96c50 R15: c9f77ed0
> FS:  7fecf7c1a700() GS:88021fd0() knlGS:
> CS:  0010 DS:  ES:  CR0: 80050033
> CR2: 8802dca4f748 CR3: 0001e47f4000 CR4: 001406e0
> DR0: 2008 DR1: 2008 DR2: 
> DR3:  DR6: fffe0ff0 DR7: 0600
> Call Trace:
>  crypto_create_tfm+0xb4/0x120 crypto/api.c:466
>  crypto_alloc_tfm+0x82/0x180 crypto/api.c:540
>  crypto_alloc_shash+0x2c/0x40 crypto/shash.c:436
>  sctp_listen_start net/sctp/socket.c:7496 [inline]
>  sctp_inet_listen+0x1c1/0x240 net/sctp/socket.c:7584
>  SYSC_listen net/socket.c:1483 [inline]
>  SyS_listen+0x71/0xb0 net/socket.c:1469
>  entry_SYSCALL_64_fastpath+0x1f/0x96
> RIP: 0033:0x452a39
> RSP: 002b:7fecf7c19c58 EFLAGS: 0212 ORIG_RAX: 0032
> RAX: ffda RBX: 00758020 RCX: 00452a39
> RDX:  RSI: 0ae0 RDI: 001b
> RBP: 00e8 R08:  R09: 
> R10:  R11: 0212 R12: 006ef660
> R13:  R14: 7fecf7c1a6d4 R15: 
> Code: ff 01 c0 4c 8d 6c 02 07 e8 a1 22 ff ff 49 83 e5 f8 48 3d 00 f0 ff ff
> 49 89 c4 77 25 e8 6d 5b c3 ff 41 8b 04 24 83 c0 10 89 43 f8 <4d> 89 65 00 45
> 31 e4 e8 57 5b c3 ff 44 89 e0 5b 41 5c 41 5d 5d
> RIP: hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169 RSP: c9f77df8
> CR2: 8802dca4f748
> ---[ end trace ec6d3df7509d0a3b ]---
> Kernel panic - not syncing: Fatal exception
> Dumping ftrace buffer:
>(ftrace buffer empty)
> Kernel Offset: disabled
> Rebooting in 86400 seconds..

Invalidating this bug since it hasn't been seen again, and it was reported while
KASAN was accidentally disabled in the syzbot config due to a change to the
kconfig menus in linux-next (so this crash was probably caused by slab
corruption elsewhere).

#syz invalid

Re: BUG: unable to handle kernel paging request in hmac_init_tfm

2017-12-22 Thread Dmitry Vyukov 
On Fri, Dec 22, 2017 at 3:27 AM, Eric Biggers  wrote:
> On Thu, Dec 21, 2017 at 08:44:03AM +0100, 'Dmitry Vyukov' via syzkaller-bugs 
> wrote:
>> On Thu, Dec 21, 2017 at 12:09 AM, Eric Biggers  wrote:
>> > On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote:
>> >> Hello,
>> >>
>> >> syzkaller hit the following crash on
>> >> 6084b576dca2e898f5c101baef151f7bfdbb606d
>> >> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
>> >> compiler: gcc (GCC) 7.1.1 20170620
>> >> .config is attached
>> >
>> > FYI, in linux-next KASAN and other memory debugging options are now behind
>> > CONFIG_DEBUG_MEMORY.  So, I think KASAN isn't getting turned on anymore, 
>> > despite
>> > the CONFIG_KASAN=y.  (Patch was "lib/: make "Memory Debugging" a 
>> > menuconfig to
>> > ease disabling it all".)
>>
>> Ouch! That would be pretty bad.
>>
>> But I've tried both linux-next HEAD at:
>>
>> commit 0e08c463db387a2adcb0243b15ab868a73f87807 (HEAD, tag:
>> next-20171221, linux-next/master)
>> Author: Stephen Rothwell 
>> Date:   Thu Dec 21 15:37:39 2017 +1100
>> Add linux-next specific files for 20171221
>>
>> and mmots HEAD at:
>>
>> commit 75aa5540627fdb3d8f86229776ea87f995275351 (HEAD, tag:
>> v4.15-rc4-mmots-2017-12-20-19-10, mmots/master)
>> Author: Linus Torvalds 
>> Date:   Thu Dec 21 04:02:17 2017 +
>> pci: test for unexpectedly disabled bridges
>>
>> and after running make olddefconfig I still see CONFIG_KASAN=y in
>> .config, nor I can find CONFIG_DEBUG_MEMORY in menuconfig.
>>
>> What am I missing? What commit has added the config?
>>
>
> Ah, I see the patch was added to -mm on 2017-12-12 but removed two days later:
>
> https://www.spinics.net/lists/mm-commits/msg129685.html
> https://www.spinics.net/lists/mm-commits/msg129696.html
>
> So it was in linux-next temporarily (including the kernel version used for 
> this
> particular bug report) but now it's not.  Just keep an eye out for it coming
> back, I guess.


I see. Then I will add CONFIG_DEBUG_MEMORY=y to our config
proactively. Without that patch olddefconfig will just wipe that
config, so should work.

Re: BUG: unable to handle kernel paging request in hmac_init_tfm

2017-12-21 Thread Eric Biggers 
On Thu, Dec 21, 2017 at 08:44:03AM +0100, 'Dmitry Vyukov' via syzkaller-bugs 
wrote:
> On Thu, Dec 21, 2017 at 12:09 AM, Eric Biggers  wrote:
> > On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote:
> >> Hello,
> >>
> >> syzkaller hit the following crash on
> >> 6084b576dca2e898f5c101baef151f7bfdbb606d
> >> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
> >> compiler: gcc (GCC) 7.1.1 20170620
> >> .config is attached
> >
> > FYI, in linux-next KASAN and other memory debugging options are now behind
> > CONFIG_DEBUG_MEMORY.  So, I think KASAN isn't getting turned on anymore, 
> > despite
> > the CONFIG_KASAN=y.  (Patch was "lib/: make "Memory Debugging" a menuconfig 
> > to
> > ease disabling it all".)
> 
> Ouch! That would be pretty bad.
> 
> But I've tried both linux-next HEAD at:
> 
> commit 0e08c463db387a2adcb0243b15ab868a73f87807 (HEAD, tag:
> next-20171221, linux-next/master)
> Author: Stephen Rothwell 
> Date:   Thu Dec 21 15:37:39 2017 +1100
> Add linux-next specific files for 20171221
> 
> and mmots HEAD at:
> 
> commit 75aa5540627fdb3d8f86229776ea87f995275351 (HEAD, tag:
> v4.15-rc4-mmots-2017-12-20-19-10, mmots/master)
> Author: Linus Torvalds 
> Date:   Thu Dec 21 04:02:17 2017 +
> pci: test for unexpectedly disabled bridges
> 
> and after running make olddefconfig I still see CONFIG_KASAN=y in
> .config, nor I can find CONFIG_DEBUG_MEMORY in menuconfig.
> 
> What am I missing? What commit has added the config?
> 

Ah, I see the patch was added to -mm on 2017-12-12 but removed two days later:

https://www.spinics.net/lists/mm-commits/msg129685.html
https://www.spinics.net/lists/mm-commits/msg129696.html

So it was in linux-next temporarily (including the kernel version used for this
particular bug report) but now it's not.  Just keep an eye out for it coming
back, I guess.

Eric

Re: BUG: unable to handle kernel paging request in hmac_init_tfm

2017-12-20 Thread Dmitry Vyukov 
On Thu, Dec 21, 2017 at 12:09 AM, Eric Biggers  wrote:
> On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote:
>> Hello,
>>
>> syzkaller hit the following crash on
>> 6084b576dca2e898f5c101baef151f7bfdbb606d
>> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
>> compiler: gcc (GCC) 7.1.1 20170620
>> .config is attached
>
> FYI, in linux-next KASAN and other memory debugging options are now behind
> CONFIG_DEBUG_MEMORY.  So, I think KASAN isn't getting turned on anymore, 
> despite
> the CONFIG_KASAN=y.  (Patch was "lib/: make "Memory Debugging" a menuconfig to
> ease disabling it all".)

Ouch! That would be pretty bad.

But I've tried both linux-next HEAD at:

commit 0e08c463db387a2adcb0243b15ab868a73f87807 (HEAD, tag:
next-20171221, linux-next/master)
Author: Stephen Rothwell 
Date:   Thu Dec 21 15:37:39 2017 +1100
Add linux-next specific files for 20171221

and mmots HEAD at:

commit 75aa5540627fdb3d8f86229776ea87f995275351 (HEAD, tag:
v4.15-rc4-mmots-2017-12-20-19-10, mmots/master)
Author: Linus Torvalds 
Date:   Thu Dec 21 04:02:17 2017 +
pci: test for unexpectedly disabled bridges

and after running make olddefconfig I still see CONFIG_KASAN=y in
.config, nor I can find CONFIG_DEBUG_MEMORY in menuconfig.

What am I missing? What commit has added the config?

Re: BUG: unable to handle kernel paging request in hmac_init_tfm

2017-12-20 Thread Eric Biggers 
On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote:
> Hello,
> 
> syzkaller hit the following crash on
> 6084b576dca2e898f5c101baef151f7bfdbb606d
> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
> 
> Unfortunately, I don't have any reproducer for this bug yet.
> 
> 
> BUG: unable to handle kernel paging request at 8802dca4f748
> IP: hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169
> PGD 404e067 P4D 404e067 PUD 0
> Oops: 0002 [#1] SMP
> Dumping ftrace buffer:
>(ftrace buffer empty)
> Modules linked in:
> CPU: 1 PID: 6418 Comm: syz-executor5 Not tainted
> 4.15.0-rc3-next-20171214+ #67
> Hardware name: Google Google Compute Engine/Google Compute Engine,
> BIOS Google 01/01/2011
> RIP: 0010:hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169
> RSP: 0018:c9f77df8 EFLAGS: 00010202
> RAX: 0068 RBX: 8801dca52308 RCX: 816847d3
> RDX: 05d6 RSI: c90004d7e000 RDI: 8802143cc708
> RBP: c9f77e10 R08: 0002bcf8 R09: 8802143cc700
> R10:  R11:  R12: 8802143cc700
> R13: 8802dca4f748 R14: 8801e0a96c50 R15: c9f77ed0
> FS:  7fecf7c1a700() GS:88021fd0() knlGS:
> CS:  0010 DS:  ES:  CR0: 80050033
> CR2: 8802dca4f748 CR3: 0001e47f4000 CR4: 001406e0
> DR0: 2008 DR1: 2008 DR2: 
> DR3:  DR6: fffe0ff0 DR7: 0600
> Call Trace:
>  crypto_create_tfm+0xb4/0x120 crypto/api.c:466
>  crypto_alloc_tfm+0x82/0x180 crypto/api.c:540
>  crypto_alloc_shash+0x2c/0x40 crypto/shash.c:436
>  sctp_listen_start net/sctp/socket.c:7496 [inline]
>  sctp_inet_listen+0x1c1/0x240 net/sctp/socket.c:7584
>  SYSC_listen net/socket.c:1483 [inline]
>  SyS_listen+0x71/0xb0 net/socket.c:1469
>  entry_SYSCALL_64_fastpath+0x1f/0x96
> RIP: 0033:0x452a39
> RSP: 002b:7fecf7c19c58 EFLAGS: 0212 ORIG_RAX: 0032
> RAX: ffda RBX: 00758020 RCX: 00452a39
> RDX:  RSI: 0ae0 RDI: 001b
> RBP: 00e8 R08:  R09: 
> R10:  R11: 0212 R12: 006ef660
> R13:  R14: 7fecf7c1a6d4 R15: 
> Code: ff 01 c0 4c 8d 6c 02 07 e8 a1 22 ff ff 49 83 e5 f8 48 3d 00 f0
> ff ff 49 89 c4 77 25 e8 6d 5b c3 ff 41 8b 04 24 83 c0 10 89 43 f8
> <4d> 89 65 00 45 31 e4 e8 57 5b c3 ff 44 89 e0 5b 41 5c 41 5d 5d
> RIP: hmac_init_tfm+0x5d/0x90 crypto/hmac.c:169 RSP: c9f77df8
> CR2: 8802dca4f748
> ---[ end trace ec6d3df7509d0a3b ]---
> Kernel panic - not syncing: Fatal exception
> Dumping ftrace buffer:
>(ftrace buffer empty)
> Kernel Offset: disabled
> Rebooting in 86400 seconds..

The crash was actually on the line 'ctx->hash = hash;' in hmac_init_tfm():

static int hmac_init_tfm(struct crypto_tfm *tfm)
{
struct crypto_shash *parent = __crypto_shash_cast(tfm);
struct crypto_shash *hash;
struct crypto_instance *inst = (void *)tfm->__crt_alg;
struct crypto_shash_spawn *spawn = crypto_instance_ctx(inst);
struct hmac_ctx *ctx = hmac_ctx(parent);

hash = crypto_spawn_shash(spawn);
if (IS_ERR(hash))
return PTR_ERR(hash);

parent->descsize = sizeof(struct shash_desc) +
   crypto_shash_descsize(hash);

ctx->hash = hash;
return 0;
}

'parent' was 8801dca52308 in RBX while 'ctx' was 8802dca4f748 in R13.
They are supposed to be almost the same but were actually quite different, so I
think the ->statesize and/or the ->cra_alignmask in the shash_alg got corrupted,
causing hmac_ctx() to return the wrong value.  I am guessing use-after-free, so
the report would have been more useful with KASAN enabled.

Eric

Re: BUG: unable to handle kernel paging request in hmac_init_tfm

2017-12-20 Thread Eric Biggers 
On Mon, Dec 18, 2017 at 11:36:01AM -0800, syzbot wrote:
> Hello,
> 
> syzkaller hit the following crash on
> 6084b576dca2e898f5c101baef151f7bfdbb606d
> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached

FYI, in linux-next KASAN and other memory debugging options are now behind
CONFIG_DEBUG_MEMORY.  So, I think KASAN isn't getting turned on anymore, despite
the CONFIG_KASAN=y.  (Patch was "lib/: make "Memory Debugging" a menuconfig to
ease disabling it all".)

Eric