On 2/12/20 8:24 pm, Tobias Markus wrote:
Hi David,
I'm afraid I can't provide an exactly matching disassembly of the
function since I've since updated to newer -rc kernels.
Another debugging hurdle is that the specific kernel code path seems
to be triggered by a very specific iwd code path that iwd only uses
for 802.1X/EAP-secured networks, and I simply wasn't near any
EAP-secured networks in the last few weeks.
I've tried creating a reproducer using a bash script calling various
keyctl commands but to no success>
David Howells wrote:
Tobias Markus <tob...@markus-regensburg.de> wrote:
kernel: RIP: 0010:public_key_verify_signature+0x189/0x3f0
Is it possible for you to provide a disassembly of this function
from the
kernel you were using? For this to occur on that line, it appears
that sig
would need to be NULL - but that should trip an assertion at the
top of the
function - or a very small number (which could be RCX, R09 or R11).
Thanks,
David
This problem is still in 5.10.4 (with iwd 1.10):
---
kernel: BUG: kernel NULL pointer dereference, address: 0000000000000000
kernel: #PF: supervisor read access in kernel mode
kernel: #PF: error_code(0x0000) - not-present page
kernel: PGD 0 P4D 0
kernel: Oops: 0000 [#6] PREEMPT SMP PTI
kernel: CPU: 7 PID: 6089 Comm: iwd Tainted: G S UD W OE
5.10.4-arch2-1 #1
kernel: Hardware name: LENOVO 20L7CTO1WW/20L7CTO1WW, BIOS N22ET60P
(1.37 ) 11/25/2019
kernel: RIP: 0010:public_key_verify_signature+0x189/0x400
kernel: Code: 48 8b 40 d0 44 89 ca 4c 89 fe 4c 89 e7 e8 ef 33 9b 00
85 c0 0f 85 80 01 00 00 48 8b 75 30 48 c7 c7 f8 84 99 ba b9 04 00 00
00 <f3> a6 0f 97 c0 1c 00 84 c0 75 0b 8b 45 50 85 c0 0f 85 e0 01 00 00
kernel: RSP: 0018:ffffaf6d811b3d50 EFLAGS: 00010246
kernel: RAX: 0000000000000000 RBX: ffff99d6a24ba540 RCX:
0000000000000004
kernel: RDX: ffff99d6a2436c00 RSI: 0000000000000000 RDI:
ffffffffba9984f8
kernel: RBP: ffffaf6d811b3e88 R08: ffff99d681b58cc0 R09:
0000000000000008
kernel: R10: 0000000000000000 R11: 000000000000000a R12:
ffff99d6a24bab40
kernel: R13: ffff99d6a2437200 R14: ffffaf6d811b3d88 R15:
ffff99d5ce134800
kernel: FS: 00007f14d1578740(0000) GS:ffff99dac75c0000(0000)
knlGS:0000000000000000
kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kernel: CR2: 0000000000000000 CR3: 00000001e26aa005 CR4:
00000000003706e0
kernel: Call Trace:
kernel: asymmetric_key_verify_signature+0x5e/0x80
kernel: keyctl_pkey_verify+0xc0/0x120
kernel: do_syscall_64+0x33/0x40
kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9
kernel: RIP: 0033:0x7f14d1675d5d
kernel: Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48
89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f
05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e3 70 0c 00 f7 d8 64 89 01 48
kernel: RSP: 002b:00007ffce76da728 EFLAGS: 00000246 ORIG_RAX:
00000000000000fa
kernel: RAX: ffffffffffffffda RBX: 00007ffce76da7b0 RCX:
00007f14d1675d5d
kernel: RDX: 0000565457d08ac0 RSI: 00007ffce76da730 RDI:
000000000000001c
kernel: RBP: 0000565457d08ac0 R08: 0000565457d0b2dd R09:
000000303ec2c07a
kernel: R10: 00007ffce76da7b0 R11: 0000000000000246 R12:
0000565457d0b2dd
kernel: R13: 00007f14d177d9c0 R14: 0000565457d0b294 R15:
00007ffce76da7b0
kernel: Modules linked in: bnep uvcvideo videobuf2_vmalloc
videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc ccm
algif_aead des_generic libdes ecb algif_skcipher cmac md4 algif_hash
af_alg btusb btrtl btbcm btintel bluetooth snd_soc_skl elan_i2c
snd_hda_codec_hdmi snd_soc_sst_ipc snd_soc_sst_dsp ecdh_generic ecc
iTCO_wdt snd_hda_ext_core iwlmvm intel_pmc_bxt
snd_soc_acpi_intel_match mei_hdcp ee1004 iTCO_vendor_support
snd_hda_codec_realtek snd_soc_acpi wmi_bmof intel_wmi_thunderbolt
snd_hda_codec_generic intel_rapl_msr snd_hda_intel mac80211
snd_intel_dspcfg soundwire_intel soundwire_generic_allocation
soundwire_cadence snd_hda_codec x86_pkg_temp_thermal intel_powerclamp
coretemp libarc4 snd_hda_core kvm_intel snd_hwdep nls_iso8859_1
soundwire_bus vfat fat kvm snd_soc_core iwlwifi snd_compress
irqbypass rapl ac97_bus intel_cstate snd_pcm_dmaengine intel_uncore
joydev snd_pcm cfg80211 mousedev mei_me pcspkr e1000e i2c_i801
snd_timer i2c_smbus mei processor_thermal_device
kernel: intel_xhci_usb_role_switch intel_rapl_common
intel_pch_thermal roles intel_soc_dts_iosf thinkpad_acpi wmi
ledtrig_audio rfkill snd int3403_thermal soundcore
int340x_thermal_zone int3400_thermal acpi_thermal_rel acpi_pad
mac_hid pkcs8_key_parser crypto_user fuse acpi_call(OE) bpf_preload
ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 uas
usb_storage dm_crypt cbc encrypted_keys dm_mod trusted tpm rng_core
crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel
aesni_intel crypto_simd cryptd glue_helper serio_raw xhci_pci
xhci_pci_renesas i915 video intel_gtt i2c_algo_bit drm_kms_helper
syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm agpgart
kernel: CR2: 0000000000000000
kernel: ---[ end trace fcbb482b549250b6 ]---
kernel: RIP: 0010:public_key_verify_signature+0x189/0x400
kernel: Code: 48 8b 40 d0 44 89 ca 4c 89 fe 4c 89 e7 e8 ef 33 9b 00
85 c0 0f 85 80 01 00 00 48 8b 75 30 48 c7 c7 f8 84 99 ba b9 04 00 00
00 <f3> a6 0f 97 c0 1c 00 84 c0 75 0b 8b 45 50 85 c0 0f 85 e0 01 00 00
kernel: RSP: 0018:ffffaf6d80ad7d50 EFLAGS: 00010246
kernel: RAX: 0000000000000000 RBX: ffff99d61f5611c0 RCX:
0000000000000004
kernel: RDX: ffff99d66714cb00 RSI: 0000000000000000 RDI:
ffffffffba9984f8
kernel: RBP: ffffaf6d80ad7e88 R08: ffff99d5c60fe760 R09:
0000000000000008
kernel: R10: 0000000000000000 R11: 000000000000000a R12:
ffff99d5e97afec0
kernel: R13: ffff99d66714d600 R14: ffffaf6d80ad7d88 R15:
ffff99d5c6e90a00
kernel: FS: 00007f14d1578740(0000) GS:ffff99dac75c0000(0000)
knlGS:0000000000000000
kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kernel: CR2: 0000000000000000 CR3: 00000001e26aa005 CR4:
00000000003706e0
systemd[1]: iwd.service: Main process exited, code=killed, status=9/KILL
systemd[1]: iwd.service: Failed with result 'signal'.
---
Here is the disassembly of public_key_verify_signature around the
faulting instruction
---
0xffffffffb9a4eaf9: mov 0x30(%rbp),%rsi
0xffffffffb9a4eafd: mov $0xffffffffba9984f8,%rdi
0xffffffffb9a4eb04: mov $0x4,%ecx
0xffffffffb9a4eb09: repz cmpsb %es:(%rdi),%ds:(%rsi) # fault here
0xffffffffb9a4eb0b: seta %al
0xffffffffb9a4eb0e: sbb $0x0,%al
0xffffffffb9a4eb10: test %al,%al
0xffffffffb9a4eb12: jne 0xffffffffb9a4eb1f
0xffffffffb9a4eb14: mov 0x50(%rbp),%eax
0xffffffffb9a4eb17: test %eax,%eax
0xffffffffb9a4eb19: jne 0xffffffffb9a4ecff
---
corresponding to this:
https://elixir.bootlin.com/linux/v5.10.4/source/crypto/asymmetric_keys/public_key.c#L359
---
if (strcmp(sig->pkey_algo, "sm2") == 0 && sig->data_size) {
ret = cert_sig_digest_update(sig, tfm);
if (ret)
goto error_free_key;
}
---
So it seems like sig->pkey_algo is null. I will try to debug, but I
don't get access to an EAP-protected network often (maybe once or
twice a week), so it might take a while.
