linux-kernel - Re: crashes in crypto_shash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9091d62b-debf-7a9e-e199-94700af954c6@roeck-us.net>
Date:   Thu, 4 Nov 2021 22:55:44 -0700
From:   Guenter Roeck <linux@...ck-us.net>
To:     Herbert Xu <herbert@...dor.apana.org.au>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Linux Crypto Mailing List <linux-crypto@...r.kernel.org>
Subject: Re: crashes in crypto_shash_update()

On 11/4/21 10:41 PM, Herbert Xu wrote:
> On Thu, Nov 04, 2021 at 10:35:41PM -0700, Guenter Roeck wrote:
>> Hi all,
>>
>> I see the following pretty widespread crash in crypto_shash_update().
>>
>> [    1.574992] Unable to handle kernel paging request at virtual address ffffffffffffffc8
>> [    1.575611] Oops [#1]
>> [    1.575698] Modules linked in:
>> [    1.575866] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W         5.15.0-10159-gb8c4a6bfae4e-dirty #1
>> [    1.576120] Hardware name: riscv-virtio,qemu (DT)
>> [    1.576281] epc : crypto_shash_update+0xa/0x2e
>> [    1.576437]  ra : crc32c+0x2c/0x58
>> [    1.576553] epc : ffffffff80358b6c ra : ffffffff80395382 sp : ffffffd00021bc00
>> [    1.576760]  gp : ffffffff81513898 tp : ffffffe001aa8040 t0 : ffffffe001d10568
>> [    1.576966]  t1 : 000000006a138faa t2 : 0000000000000000 s0 : ffffffd00021bc10
>> [    1.577173]  s1 : ffffffff8149e500 a0 : ffffffd00021bc10 a1 : ffffffff81077e70
>> [    1.577378]  a2 : 0000000000000011 a3 : 0000000000000000 a4 : ffffffffffffffb0
>> [    1.577584]  a5 : ffffffffffffffb0 a6 : 0000000000000000 a7 : 0000000028292846
>> [    1.577797]  s2 : ffffffff81077e70 s3 : ffffffff81514008 s4 : ffffffff80c004e0
>> [    1.578005]  s5 : ffffffff81514038 s6 : ffffffff80c10910 s7 : ffffffff80c004a0
>> [    1.578212]  s8 : ffffffff811669a8 s9 : 0000000000000008 s10: ffffffff80a000ac
>> [    1.578421]  s11: 0000000000000000 t3 : 0000000000000009 t4 : 0000000042300000
>> [    1.578628]  t5 : 0000000000000000 t6 : ffffffe003075000
>> [    1.578785] status: 0000000000000120 badaddr: ffffffffffffffc8 cause: 000000000000000d
>> [    1.579010] [<ffffffff80358b6c>] crypto_shash_update+0xa/0x2e
>> [    1.579186] [<ffffffff80395382>] crc32c+0x2c/0x58
>> [    1.579332] [<ffffffff80a1459a>] btrfs_props_init+0x32/0x70
>> [    1.579505] [<ffffffff80a13e26>] init_btrfs_fs+0x12/0x16a
>> [    1.579670] [<ffffffff800020da>] do_one_initcall+0x36/0x15e
>> [    1.579838] [<ffffffff80a00f5c>] kernel_init_freeable+0x1a6/0x20a
>> [    1.580023] [<ffffffff808d6648>] kernel_init+0x1e/0x104
>> [    1.580181] [<ffffffff80002ffa>] ret_from_exception+0x0/0xc
>> [    1.580700] ---[ end trace 4bfa11496ef965ab ]---
>>
>>
>> The problem boils down to crypto_alloc_shash() returning -80 (-ELLIBBAD).
>>
>> Before I spend time analyzing this further, is anyone already looking
>> into the problem ?
> 
> Can you confirm that CRYPTO_MANAGER is unset in your config? If
> so I'm aware of the problem and working on a fix.
> 

Yes. Also, I found out that (blindly - bisect didn't work) reverting commit
cad439fc040e ("crypto: api - Do not create test larvals if manager is disabled")
fixes the problem.

It might also be worthwhile to add some error checking into lib/libcrc32c.c
to avoid dereferencing the ERR_PTR.

Thanks,
Guenter