netdev - Re: TLS record double free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 26 Aug 2019 14:32:37 -0700
From:   Jakub Kicinski <jakub.kicinski@...ronome.com>
To:     Mallesham Jatharakonda <mallesh537@...il.com>
Cc:     borisp@...lanox.com, davejwatson@...com, daniel@...earbox.net,
        davem@...emloft.net, ast@...nel.org, kafai@...com,
        netdev@...r.kernel.org, bpf@...r.kernel.org
Subject: Re: TLS record double free

Thank you for the report.

On Sun, 25 Aug 2019 22:21:50 +0530, Mallesham Jatharakonda wrote:
> Hi All,
> 
> Am facing one tls double while using the Nitrox(cavium) card and n5pf
> driver over the TLS module.
> 
> Please see the below details:
> 
> TLS module is crashing While running SSL record encryption using
> Klts_send_[file]
> 
> Precondition:
> 1) Installed 5.3-rc4.
> 2) Nitrox5 card pluggin.

Presumably this card contains a crypto accelerator? Does it have any
special characteristic which could help us narrow down the bug search?

Before we proceed - are you able to reproduce this issue with an
pure upstream kernel? It seems the kernel in the BUG report is tainted.

> Steps to produce the issue:
> 1) Install n5pf.ko.(drivers/crypto/cavium/nitrox)
> 2) Install tls.ko if not is installed by default(net/tls)
> 3) Taken uperf tool from git.
>    3.1) Modified uperf to use tls module by using setsocket.
>    3.2) Modified uperf tool to support sendfile with SSL.
> 
> 
> Test:
> 1) Running uperf with 4threads.
> 2) Each Thread send the data using sendfile over SSL protocol.
> 
> 
> After few seconds kernel is crashing because of record list corruption
> 
> 
> [  270.888952] ------------[ cut here ]------------
> [  270.890450] list_del corruption, ffff91cc3753a800->prev is
> LIST_POISON2 (dead000000000122)
> [  270.891194] WARNING: CPU: 1 PID: 7387 at lib/list_debug.c:50
> __list_del_entry_valid+0x62/0x90
> [  270.892037] Modules linked in: n5pf(OE) netconsole tls(OE) bonding
> intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal
> intel_powerclamp coretemp kvm_intel kvm iTCO_wdt iTCO_vendor_support
> irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel
> aesni_intel crypto_simd mei_me cryptd glue_helper ipmi_si sg mei
> lpc_ich pcspkr joydev ioatdma i2c_i801 ipmi_devintf ipmi_msghandler
> wmi ip_tables xfs libcrc32c sd_mod mgag200 drm_vram_helper ttm
> drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm isci
> libsas ahci scsi_transport_sas libahci crc32c_intel serio_raw igb
> libata ptp pps_core dca i2c_algo_bit dm_mirror dm_region_hash dm_log
> dm_mod [last unloaded: nitrox_drv]
> [  270.896836] CPU: 1 PID: 7387 Comm: uperf Kdump: loaded Tainted: G
>         OE     5.3.0-rc4 #1