linux-kernel - Re: Another regression in the af

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZLCumw4oY5QGL8Wi@debian.me>
Date:   Fri, 14 Jul 2023 09:10:35 +0700
From:   Bagas Sanjaya <bagasdotme@...il.com>
To:     Ondrej Mosnáček <omosnacek@...il.com>,
        Linux Crypto Mailing List <linux-crypto@...r.kernel.org>
Cc:     David Howells <dhowells@...hat.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org,
        regressions@...ts.linux.dev,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: Another regression in the af_alg series (s390x-specific)

On Thu, Jul 13, 2023 at 10:03:45AM +0200, Ondrej Mosnáček wrote:
> Hi,
> 
> It turns out that beneath the first bug [1] there was another one
> hiding. It seems to happen only on the s390x architecture when running
> the following libkcapi [2] reproducer:
> 
> kcapi -x 2 -s -c "gcm(aes)" -i 0d92aa861746b324f20ee6b7 \
>     -k f4a6a5e5f2066f6dd9ec6fc5169c29043560ef595c9e81e76f42d29212cc581c \
>     -a "" -t 5f24c68cbe6f32c29652442bf5d483ad -q ""
> 
> Frequently (but not always) it triggers an oops like this one:
> 
> [ 3986.766763] Unable to handle kernel pointer dereference in virtual
> kernel address space
> [ 3986.766774] Failing address: 0000000a00000000 TEID: 0000000a00000803
> [ 3986.766776] Fault in home space mode while using kernel ASCE.
> [ 3986.766778] AS:00000000a43a0007 R3:0000000000000024
> [ 3986.766825] Oops: 003b ilc:2 [#1] SMP
> <snip>
> [ 3986.766877] CPU: 0 PID: 271064 Comm: kcapi Tainted: G        W
>     6.5.0-rc1 #1
> [ 3986.767070] Hardware name: IBM 8561 LT1 400 (z/VM 7.2.0)
> <snip>
> [ 3986.767151] Call Trace:
> [ 3986.767153]  [<000003ff7fc3d47e>] gcm_walk_start+0x16/0x28 [aes_s390]
> [ 3986.767160]  [<00000000a2a342f2>] crypto_aead_decrypt+0x9a/0xb8
> [ 3986.767166]  [<00000000a2a60888>] aead_recvmsg+0x478/0x698
> [ 3986.767169]  [<00000000a2e519a0>] sock_recvmsg+0x70/0xb0
> [ 3986.767175]  [<00000000a2e51a56>] sock_read_iter+0x76/0xa0
> [ 3986.767177]  [<00000000a273e066>] vfs_read+0x26e/0x2a8
> [ 3986.767182]  [<00000000a273e8c4>] ksys_read+0xbc/0x100
> [ 3986.767184]  [<00000000a311d808>] __do_syscall+0x1d0/0x1f8
> [ 3986.767189]  [<00000000a312ff30>] system_call+0x70/0x98
> [ 3986.767193] Last Breaking-Event-Address:
> [ 3986.767193]  [<000003ff7fc3e6b4>] gcm_aes_crypt+0x104/0xa68 [aes_s390]
> [ 3986.767198] Kernel panic - not syncing: Fatal exception: panic_on_oops
> 
> This time the regression was bisected to:
> 
> commit c1abe6f570aff4b6d396dc551e60570d2f50bd79
> Author: David Howells <dhowells@...hat.com>
> Date:   Tue Jun 6 14:08:52 2023 +0100
> 
>    crypto: af_alg: Use extract_iter_to_sg() to create scatterlists
> 
> I can't see what the problem is with the commit, so I'm reporting here
> hoping that David or someone else can pick it up from here.
> 

Thanks for the regression report. I'm adding it to regzbot:

#regzbot ^introduced: c1abe6f570aff4b
#regzbot title: kernel pointer dereference regression due to extract_iter_to_sg()

-- 
An old man doll... just what I always wanted! - Clara

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)