linux-kernel - KASAN related bug in crypto/asymmetric_keys/public

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 21 Jun 2017 15:25:01 +0800
From:   Peter Teoh <htmldeveloper@...il.com>
To:     LKML <linux-kernel@...r.kernel.org>
Subject: KASAN related bug in crypto/asymmetric_keys/public_key.c:96

I got the following dump during startup (4.11.0 stable):

[    1.353688] registered taskstats version 1
[    1.353974] Loading compiled-in X.509 certificates
[    1.354582] ------------[ cut here ]------------
[    1.354904] kernel BUG at crypto/asymmetric_keys/public_key.c:96!
[    1.355319] invalid opcode: 0000 [#1] SMP KASAN
[    1.355628] Modules linked in:
[    1.355843] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.11.0syz #10
[    1.356266] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[    1.356901] task: ffff88006c538000 task.stack: ffff88006c540000
[    1.357308] RIP: 0010:public_key_verify_signature+0x772/0x9b0
[    1.357698] RSP: 0000:ffff88006c547840 EFLAGS: 00010297
[    1.358053] RAX: ffff88006c538000 RBX: ffff88006a46e9c0 RCX: 0000000000000005
[    1.358537] RDX: 0000000000000000 RSI: ffff88006a46e9c0 RDI: ffff88006a46de70
[    1.359013] RBP: ffff88006c547a18 R08: ffffed000d48dd93 R09: ffffed000d48dd93
[    1.359488] R10: 0000000000000000 R11: ffffed000d48dd94 R12: dffffc0000000000
[    1.359962] R13: ffff88006a46de70 R14: ffffffff82ba4440 R15: 1ffff1000d8a8f0e
[    1.360442] FS:  0000000000000000(0000) GS:ffff88006d000000(0000)
knlGS:0000000000000000
[    1.360986] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    1.361376] CR2: 0000000000000000 CR3: 000000000300d000 CR4: 00000000000006f0
[    1.361855] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    1.362333] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    1.362914] Call Trace:
[    1.363092]  ? public_key_describe+0xd0/0xd0
[    1.363390]  ? kasan_slab_free+0x89/0xc0
[    1.363660]  ? crypto_larval_destroy+0x110/0x150
[    1.363977]  ? kfree+0x96/0x1b0
[    1.364195]  ? crypto_larval_destroy+0x110/0x150
[    1.364513]  ? crypto_larval_wait+0x1e0/0x1e0
[    1.364813]  ? crypto_larval_kill+0x16f/0x1d0
[    1.365113]  ? kasan_unpoison_shadow+0x35/0x50
[    1.365418]  ? kasan_kmalloc+0xad/0xe0
[    1.365678]  x509_check_for_self_signed+0x324/0x520
[    1.366012]  x509_cert_parse+0x4b6/0x670
[    1.366295]  x509_key_preparse+0x69/0x860
[    1.366573]  ? __printk_safe_exit+0xe/0x20
[    1.366856]  asymmetric_key_preparse+0xd3/0x1b0
[    1.367166]  ? memset+0x31/0x40
[    1.367385]  ? asymmetric_key_free_preparse+0x190/0x190
[    1.367743]  key_create_or_update+0x365/0xa00
[    1.368043]  ? key_type_lookup+0xe0/0xe0
[    1.368314]  ? vprintk_default+0x74/0xf0
[    1.368584]  ? vprintk_func+0x4c/0x90
[    1.368839]  ? printk+0xbe/0xf2
[    1.369059]  load_system_certificate_list+0x1ab/0x240
[    1.369402]  ? system_trusted_keyring_init+0x9d/0x9d
[    1.369755]  do_one_initcall+0xb9/0x280
[    1.370030]  ? initcall_blacklisted+0x1b0/0x1b0
[    1.370344]  ? parse_args+0x228/0xb60
[    1.370607]  kernel_init_freeable+0x528/0x612
[    1.370937]  ? start_kernel+0x70b/0x70b
[    1.371215]  ? compat_start_thread+0x80/0x80
[    1.371544]  ? rest_init+0xb0/0xb0
[    1.371805]  kernel_init+0x18/0x180
[    1.372055]  ? rest_init+0xb0/0xb0
[    1.372300]  ret_from_fork+0x2c/0x40
[    1.372610] Code: ff ff e8 52 8a 8a ff 48 8b bd 50 fe ff ff e8 66
77 b1 ff e9 58 fb ff ff e8 3c 8a 8a ff 0f 0b e8 35 8a 8a ff 0f 0b e8
2e 8a 8a ff <0f> 0b e8 27 8a 8a ff 0f 0b e8 20 8a 8a ff 41 bd f4 ff ff
ff e9
[    1.374192] RIP: public_key_verify_signature+0x772/0x9b0 RSP:
ffff88006c547840
[    1.374840] ---[ end trace 6fefa18a45f0fc9e ]---
[    1.375242] Kernel panic - not syncing: Fatal exception
[    1.375736] Kernel Offset: disabled
[    1.376026] ---[ end Kernel panic - not syncing: Fatal exception


Tracing into public_key.c:

 94         BUG_ON(!pkey);
 95         BUG_ON(!sig);
 96         BUG_ON(!sig->digest);
 97         BUG_ON(!sig->s);
 98

There is no check on the digest and length being zero anywhere.   And
not sure where is the right place to intialize if any.

Is this a bug?  Thanks.