Hi,
Fedora got a bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=1395896
of an oops with this program:
#include <linux/if_alg.h>
#include <stddef.h>
#include <sys/socket.h>
int main(int argc, char *argv[]) {
static const union {
struct sockaddr sa;
struct sockaddr_alg alg;
} sa = {
.alg.salg_family = AF_ALG,
.alg.salg_type = "hash",
.alg.salg_name = "sha256",
};
char c;
int fd1, fd2;
fd1 = socket(AF_ALG, SOCK_SEQPACKET, 0);
bind(fd1, &sa.sa, sizeof(sa));
fd2 = accept(fd1, NULL, 0);
recv(fd2, &c, sizeof(c), 0);
return 0;
}
[ 10.802304] BUG: unable to handle kernel NULL pointer dereference at
0000000000000008
[ 10.803970] IP: [<ffffffff812f743e>] shash_ahash_digest+0x1e/0x100
[ 10.805046] PGD eb37067 PUD 12425067 PMD 0
[ 10.806019] Oops: 0000 [#1] SMP
[ 10.806702] Modules linked in:
[ 10.807421] CPU: 0 PID: 1098 Comm: a.out Not tainted 4.8.0-rc1+ #29
[ 10.808444] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.9.1-1.fc24 04/01/2014
[ 10.809839] task: ffff880010a92400 task.stack: ffff880012458000
[ 10.810653] RIP: 0010:[<ffffffff812f743e>] [<ffffffff812f743e>]
shash_ahash_digest+0x1e/0x100
[ 10.811979] RSP: 0018:ffff88001245bd48 EFLAGS: 00010246
[ 10.812730] RAX: 0000000000001000 RBX: ffff88001249b390 RCX: 0000000000000000
[ 10.814419] RDX: 0000000000000000 RSI: ffff88001249b390 RDI: ffff88001249b340
[ 10.815303] RBP: ffff88001245bd68 R08: ffff88000eb54fa0 R09: 0000000000000000
[ 10.816126] R10: ffff88000eb547d0 R11: 0000000000000001 R12: ffffffff812f7520
[ 10.816946] R13: ffff88001249b340 R14: ffff88001245be38 R15: 0000000000000000
[ 10.818098] FS: 00007f1849f3a700(0000) GS:ffff880011800000(0000)
knlGS:0000000000000000
[ 10.819644] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 10.820370] CR2: 0000000000000008 CR3: 000000000eb36000 CR4: 00000000000006f0
[ 10.821198] Stack:
[ 10.821641] ffff88001249b340 ffffffff812f7520 ffff880012498c18
ffff88001245be38
[ 10.822905] ffff88001245bd78 ffffffff812f753f ffff88001245bda0
ffffffff812f6aa4
[ 10.824168] ffff88001249b060 ffff88001249b060 0000000000000001
ffff88001245bdb0
[ 10.825434] Call Trace:
[ 10.825910] [<ffffffff812f7520>] ? shash_ahash_digest+0x100/0x100
[ 10.826663] [<ffffffff812f753f>] shash_async_digest+0x1f/0x30
[ 10.827389] [<ffffffff812f6aa4>] crypto_ahash_op+0x24/0x60
[ 10.828097] [<ffffffff812f6b31>] crypto_ahash_digest+0x11/0x20
[ 10.828835] [<ffffffff813087a4>] hash_recvmsg+0x1a4/0x1c0
[ 10.829539] [<ffffffff817253b8>] sock_recvmsg+0x38/0x40
[ 10.830232] [<ffffffff817255ab>] SYSC_recvfrom+0xcb/0x130
[ 10.830937] [<ffffffff81724ccf>] ? sock_map_fd+0x3f/0x60
[ 10.831635] [<ffffffff81726729>] SyS_recvfrom+0x9/0x10
[ 10.832317] [<ffffffff81922572>] entry_SYSCALL_64_fastpath+0x1a/0xa4
[ 10.833091] Code: 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 55 b8 00 10 00 00
48 89 e5 41 56 41 55 41 54 53 49 89 fd 48 8b 4f 38 41 8b 55 30 48 89 f3 <8b> 79
08 29 f8 39 41 0c 0f 46 41 0c 39 c2 73 74 48 8b 31 48 83
[ 10.838754] RIP [<ffffffff812f743e>] shash_ahash_digest+0x1e/0x100
[ 10.839560] RSP <ffff88001245bd48>
[ 10.840112] CR2: 0000000000000008
[ 10.840674] ---[ end trace 4314dcc948f7acad ]---
[ 10.841320] Kernel panic - not syncing: Fatal exception
[ 10.842106] Kernel Offset: disabled
It looks like hash_recvmsg sets the sg to NULL with
ahash_request_set_crypt(&ctx->req, NULL, ctx->result, 0);
which then blows up when crypto_ahash_digest -> hash_ahash_digest
tries to access it.
Thanks,
Laura
--
To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
