Am Dienstag, 8. Dezember 2015, 12:12:27 schrieb Dmitry Vyukov: Hi Dmitry, >Hello, > >The following program triggers a WARNING in crypto_wait_for_test: > >// autogenerated by syzkaller (http://github.com/google/syzkaller) >#include <syscall.h> >#include <string.h> >#include <stdint.h> > >int main() >{ > long r0 = syscall(SYS_mmap, 0x20000000ul, 0x1000ul, 0x3ul, >0x32ul, 0xfffffffffffffffful, 0x0ul); > long r1 = syscall(SYS_socket, 0x26ul, 0x5ul, 0x0ul, 0, 0, 0); > *(uint16_t*)0x20000000 = 0x26; > memcpy((void*)0x20000002, >"\x73\x6b\x63\x69\x70\x68\x65\x72\x00\x00\x00\x00\x00\x00", 14); > *(uint32_t*)0x20000010 = 0x1008; > *(uint32_t*)0x20000014 = 0x469b167b45d89a6; The error is triggered by this ^^^^ line. This line sets sockaddr_alg->mask to some strange value. I assume that the mask does not allow the crypto API to find the test. Herbert, alg_bind currently blacklists one bit in the mask and type bit array. Shouldn't we instead white-list the allowed bits? > memcpy((void*)0x20000018, >"\x63\x74\x72\x28\x64\x65\x73\x33\x5f\x65\x64\x65\x29\x00\x00\x00\x00\x00\x00 >\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ >x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x >00\x00\x00\x00\x00\x00\x00", 64); > long r7 = syscall(SYS_bind, r1, 0x20000000ul, 0x58ul, 0, 0, 0); > return 0; >} > > >------------[ cut here ]------------ >WARNING: CPU: 1 PID: 11087 at crypto/algapi.c:343 >crypto_wait_for_test+0xc4/0xf0() >Modules linked in: >CPU: 1 PID: 11087 Comm: a.out Tainted: G W 4.4.0-rc3+ #151 >Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > 0000000000000001 ffff88006ca07a78 ffffffff82e0f4b8 0000000041b58ab3 > ffffffff87a9a265 ffffffff82e0f406 ffff88003711e080 00000000ffffffff > ffffffff89913aa0 0000000000000001 0000000000000001 0000000000002b4f >Call Trace: > [< inline >] __dump_stack lib/dump_stack.c:15 > [<ffffffff82e0f4b8>] dump_stack+0xb2/0xfa lib/dump_stack.c:50 > [<ffffffff81373336>] warn_slowpath_common+0xe6/0x170 kernel/panic.c:460 > [<ffffffff81373589>] warn_slowpath_null+0x29/0x30 kernel/panic.c:493 > [<ffffffff82ba29e4>] crypto_wait_for_test+0xc4/0xf0 crypto/algapi.c:343 > [<ffffffff82ba2d20>] crypto_register_instance+0x220/0x350 >crypto/algapi.c:558 [<ffffffff82ba9564>] >crypto_givcipher_default+0x4f4/0x620 >crypto/ablkcipher.c:601 > [<ffffffff82ba984a>] crypto_lookup_skcipher+0x1ba/0x2f0 >crypto/ablkcipher.c:658 [<ffffffff82ba9aae>] >crypto_alloc_ablkcipher+0x5e/0x1f0 crypto/ablkcipher.c:693 >[<ffffffff82d2a875>] skcipher_bind+0x25/0x30 crypto/algif_skcipher.c:754 >[<ffffffff82d28129>] alg_bind+0x1a9/0x410 crypto/af_alg.c:155 > [<ffffffff856b3a6a>] SYSC_bind+0x20a/0x2c0 net/socket.c:1383 > [<ffffffff856b70f4>] SyS_bind+0x24/0x30 net/socket.c:1369 > [<ffffffff86a89fb6>] entry_SYSCALL_64_fastpath+0x16/0x7a >arch/x86/entry/entry_64.S:185 >---[ end trace 49f86739a736fa2b ]--- > > >strace: >socket(PF_ALG, SOCK_SEQPACKET, 0) = 3 >bind(3, {sa_family=AF_ALG, sa_data="skcipher\0\0\0\0\0\0"}, 88) = -1 >ENOENT (No such file or directory) > > >On commit 31ade3b83e1821da5fbb2f11b5b3d4ab2ec39db8 (Nov 29). >-- >To unsubscribe from this list: send the line "unsubscribe linux-crypto" in >the body of a message to majordomo@xxxxxxxxxxxxxxx >More majordomo info at http://vger.kernel.org/majordomo-info.html Ciao Stephan -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
