Hi, I'm seeing rare crashes during NFS cthon with krb5 auth. After some digging I arrived at potential problem with sha1-avx2. Problem appears to be that sha1_transform_avx2() reads beyond number of blocks you pass, if it is an odd number. It appears to try read one block more. This creates a problem if it falls beyond a page and there's nothing there. To demonstrate this, I made a module which computes some hashes on module load. It allocates 3 pages, passes first two into crypto_shash_update() and marks 3rd one as not present. When it runs for sha1-avx2, it runs into an Oops, trying to access 3rd page: # git clone https://github.com/jstancek/sha1-avx2-crash.git # cd sha1-avx2-crash/ # make # insmod sha1_test.ko [ 195.512669] sha1_test: loading out-of-tree module taints kernel. [ 195.518716] sha1_test: module verification failed: signature and/or required key missing - tainting kernel [ 195.529754] sha_test module loaded [ 195.533732] data is at 0xffff97e232ea8000, datalen: 12288, start_offset: 3948, last_byte: 0xffff97e232ea9fff [ 195.543529] page_after_data is at 0xffff97e232eaa000 [ 195.548603] starting test for sha1-generic [ 195.552703] count: 148 [ 195.555073] starting test for sha1-ni [ 195.561282] failed to alloc sha1-ni [ 195.564776] starting test for sha1-avx [ 195.568544] count: 148 [ 195.570908] starting test for sha1-avx2 [ 195.574751] count: 148 [ 195.577135] BUG: unable to handle kernel paging request at ffff97e232eaa000 [ 195.584081] IP: _begin+0x173/0x187 [ 195.587478] PGD 213e83067 [ 195.587478] PUD 1033622063 [ 195.590183] PMD 1033181063 [ 195.592974] PTE 8000001032eaa062 [ 195.595769] [ 195.600487] Oops: 0000 [#1] SMP [ 195.603627] Modules linked in: sha1_test(OE+) binfmt_misc intel_rapl skx_edac edac_core x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel vfat pcbc fat aesni_intel crypto_simd glue_helper cryptd ipmi_ss if ipmi_si iTCO_wdt ioatdma mei_me ipmi_devintf iTCO_vendor_support pcspkr joydev nfsd sg mei shpchp i2c_i801 dca lpc_ich wmi ipmi_msghand ler nfs_acl lockd tpm_crb nfit auth_rpcgss libnvdimm grace acpi_pad acpi_power_meter sunrpc ip_tables xfs libcrc32c sd_mod sr_mod cdrom as t i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm i40e ahci ptp libahci crc32c_intel libata pps_core i2c _core dm_mirror dm_region_hash dm_log dm_mod [ 195.667322] CPU: 3 PID: 4725 Comm: insmod Tainted: G OE 4.11.0-rc8 #1 [ 195.674782] Hardware name: Intel Corporation S2600WFD/S2600WFD, BIOS SE5C620.86B.01.00.0412.020920172159 02/09/2017 [ 195.685185] task: ffff97e22a7b3b00 task.stack: ffffa6f9a57e8000 [ 195.691092] RIP: 0010:_begin+0x173/0x187 [ 195.695005] RSP: 0018:ffffa6f9a57eb5d8 EFLAGS: 00010202 [ 195.700219] RAX: 0000000024a63b1a RBX: 00000000de142126 RCX: 00000000455ad007 [ 195.707336] RDX: 00000000325cbadf RSI: 000000002c3b9293 RDI: 000000009298ec68 [ 195.714451] RBP: 0000000045421007 R08: ffffffff9640a100 R09: ffff97d3771be9d0 [ 195.721567] R10: ffff97e232ea9f2c R11: ffff97e232eaa02c R12: 00000000531d8d12 [ 195.728683] R13: ffff97e232ea9f6c R14: ffffa6f9a57eb878 R15: ffffa6f9a57eb5d8 [ 195.735799] FS: 00007f675ac0c740(0000) GS:ffff97e23dac0000(0000) knlGS:0000000000000000 [ 195.743864] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 195.749596] CR2: ffff97e232eaa000 CR3: 00000010394ec000 CR4: 00000000007406e0 [ 195.756713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 195.763828] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 195.770944] PKRU: 55555554 [ 195.773651] Call Trace: [ 195.776105] ? dequeue_entity+0xed/0x400 [ 195.780027] ? console_unlock+0x475/0x4a0 [ 195.784027] ? sha1_base_init+0x40/0x40 [ 195.787858] ? sha1_apply_transform_avx2+0x1a/0x30 [ 195.792638] ? sha1_update+0xd3/0x130 [ 195.796295] ? sha1_avx2_update+0x15/0x20 [ 195.800301] ? crypto_shash_update+0x47/0x120 [ 195.804650] ? calc_hash.constprop.0+0xdc/0xff [sha1_test] [ 195.810122] ? sha1test_init+0x113/0x1000 [sha1_test] [ 195.815163] ? 0xffffffffc02b7000 [ 195.818473] ? do_one_initcall+0x51/0x1b0 [ 195.822481] ? __vunmap+0x85/0xd0 [ 195.825799] ? kmem_cache_alloc_trace+0x14b/0x1b0 [ 195.830489] ? kfree+0x133/0x180 [ 195.833716] ? do_init_module+0x60/0x1fa [ 195.837638] ? load_module+0x162b/0x1b20 [ 195.841557] ? __symbol_put+0x60/0x60 [ 195.845217] ? ima_post_read_file+0x3d/0x80 [ 195.849397] ? security_kernel_post_read_file+0x6b/0x80 [ 195.854616] ? SYSC_finit_module+0xa6/0xf0 [ 195.858704] ? SyS_finit_module+0xe/0x10 [ 195.862622] ? do_syscall_64+0x67/0x180 [ 195.866450] ? entry_SYSCALL64_slow_path+0x25/0x25 [ 195.871230] Code: d0 02 c4 c1 7a 6f 82 90 00 00 00 21 c8 31 e8 42 8d 3c 27 41 03 77 44 c4 e2 40 f2 e9 8d 34 06 c4 63 7b f0 e7 1b c4 e3 7b f0 c7 02 <c4> c3 7d 18 85 90 00 00 00 01 21 d7 31 ef 42 8d 34 26 eb 00 41 [ 195.890035] RIP: _begin+0x173/0x187 RSP: ffffa6f9a57eb5d8 [ 195.895423] CR2: ffff97e232eaa000 [ 195.898841] ---[ end trace ae28f02b9d28fb26 ]--- [ 195.905994] Kernel panic - not syncing: Fatal exception [ 195.911412] Kernel Offset: 0x14c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 195.924685] Rebooting in 10 seconds.. Regards, Jan
