linux-kernel - Question on page length clamping in hash walk fix and syscall crashes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 28 Jul 2016 11:49:47 +0200 (CEST)
From:	Xavier Roche <rocheml@...rack.com>
To:	LKML <linux-kernel@...r.kernel.org>
Subject: Question on page length clamping in hash walk fix and syscall
 crashes

Hi folks,

We stumble upon an issue while using an AF_ALG socket to compute a hash 
(crc32) directly in the kernel (using splice magic)

The issue has been fixed AFAICS by Herbert Xu in 
cc440a5b68873b7b98c3130d09a69a1b13acb0b7 in a rather isolated patch (three 
lines diff)

I could validate that the patch does indeed fix the issue we were having.

This bug seems to be more than a computation issue, as we experienced 
weird crashes in random syscall when it is triggered (ie. unpatched), 
such as fork, or futex-related primitives (!).

The issue can be reproduced with this standalone program:
https://bitbucket.org/scality/xavier-sandbox-public/raw/HEAD/kernel/issues/splicertest.c

Most up-to-date stable distro are using the buggy version (Centos 7: 
3.10.0, Ubuntu trusty: 3.13.0, Fedora 22: 4.3.6, etc.)

Question: is the weird behavior observed (crashes inside kernel) 
"normal" w.r.t this issue, and how cherry-pick policy is organized w.r.t 
older kernel releases (LTS only ?)

[ Typically the bug does not appear in 3.14.70, 3.16.0, 3.19.0 or 4.2.0 ]

And sorry in advance if this question has already been answered, but I 
could not find any clear hint.