syzbot


BUG: unable to handle kernel NULL pointer dereference in sha512_mb_mgr_get_comp_job_avx2

Status: fixed on 2018/02/26 20:04
Subsystems: crypto
[Documentation on labels]
Reported-by: syzbot+5ac9d43b97a33f321ed58e24960e30defaef843f@syzkaller.appspotmail.com
Fix commit: eff84b379089 crypto: sha512-mb - initialize pending lengths correctly
First crash: 2364d, last: 2305d

Sample crash report:
BUG: unable to handle kernel NULL pointer dereference at 00000000c58b0b19
IP: sha512_mb_mgr_get_comp_job_avx2+0x6e/0xee arch/x86/crypto/sha512-mb/sha512_mb_mgr_flush_avx2.S:251
PGD 1cb562067 P4D 1cb562067 PUD 1cb563067 PMD 0 
Oops: 0002 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 4.15.0-rc1-mm1+ #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: crypto mcryptd_queue_worker
task: 0000000018ff7174 task.stack: 000000004c6e7fb4
RIP: 0010:sha512_mb_mgr_get_comp_job_avx2+0x6e/0xee arch/x86/crypto/sha512-mb/sha512_mb_mgr_flush_avx2.S:251
RSP: 0018:ffff8801d9d171b8 EFLAGS: 00010002
RAX: 0000000000000000 RBX: ffff8801d5aa38d0 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8801d5aa3780
RBP: ffff8801d9d171e0 R08: 0000000100000000 R09: 0000000000000001
R10: 0000000000000002 R11: 0000000000000003 R12: ffff8801d5aa3780
R13: 0000000000000282 R14: ffff8801cc115760 R15: ffffe8ffffd10630
FS:  0000000000000000(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000060 CR3: 00000001cb55f000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 sha_complete_job+0x276/0x830 arch/x86/crypto/sha512-mb/sha512_mb.c:510
 sha512_mb_update+0x2f6/0x530 arch/x86/crypto/sha512-mb/sha512_mb.c:610
 crypto_ahash_update include/crypto/hash.h:522 [inline]
 ahash_mcryptd_update crypto/mcryptd.c:628 [inline]
 mcryptd_hash_update+0xcd/0x1c0 crypto/mcryptd.c:374
 mcryptd_queue_worker+0xfe/0x660 crypto/mcryptd.c:182
 process_one_work+0xbfd/0x1bc0 kernel/workqueue.c:2113
 worker_thread+0x223/0x1990 kernel/workqueue.c:2247
 kthread+0x37a/0x440 kernel/kthread.c:238
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:517
Code: 49 0f 42 d3 48 f7 c2 f0 ff ff ff 0f 85 9a 00 00 00 48 83 e2 0f 48 6b da 08 48 8d 9c 1f 48 01 00 00 48 8b 03 48 c7 03 00 00 00 00 <c7> 40 60 02 00 00 00 48 8b 9f 40 01 00 00 48 c1 e3 08 48 09 d3 
RIP: sha512_mb_mgr_get_comp_job_avx2+0x6e/0xee arch/x86/crypto/sha512-mb/sha512_mb_mgr_flush_avx2.S:251 RSP: ffff8801d9d171b8
CR2: 0000000000000060
---[ end trace 2003a6fbb2bb168e ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (32):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/12/03 20:30 mmots 4131d5166185 29b0fd90 .config console log report syz ci-upstream-mmots-kasan-gce
2018/01/20 10:21 upstream 8dd903d2cf7b fbbdcd92 .config console log report ci-upstream-kasan-gce
2018/01/07 19:54 upstream 3219e264b984 19c05fff .config console log report ci-upstream-kasan-gce
2017/12/18 05:34 upstream b9f5fb1800d8 d5beb42a .config console log report ci-upstream-kasan-gce
2017/12/06 16:30 upstream 328b4ed93b69 0796857b .config console log report ci-upstream-kasan-gce
2017/12/05 01:10 upstream 2391f0b4808e de212f1a .config console log report ci-upstream-kasan-gce
2018/01/21 17:24 net-next-old cbcbeedbfd76 fbbdcd92 .config console log report ci-upstream-net-kasan-gce
2018/01/26 08:01 net-next-old fb07a820fe3f 1d18b112 .config console log report ci-upstream-net-kasan-gce
2018/01/13 09:20 net-next-old 6bd39bc3da0f 9dc808a6 .config console log report ci-upstream-net-kasan-gce
2017/12/04 09:59 net-next-old c6d3c96f8d52 48359b97 .config console log report ci-upstream-net-kasan-gce
2017/12/02 14:11 net-next-old c5f66a858997 48359b97 .config console log report ci-upstream-net-kasan-gce
2017/11/30 17:36 net-next-old b78a6aa3876b 5153aeaf .config console log report ci-upstream-net-kasan-gce
2017/11/29 12:22 net-next-old 1d3b78bbc6e9 29b0fd90 .config console log report ci-upstream-net-kasan-gce
2017/11/29 09:40 net-next-old 1d3b78bbc6e9 29b0fd90 .config console log report ci-upstream-net-kasan-gce
2017/11/29 07:13 net-next-old 1d3b78bbc6e9 29b0fd90 .config console log report ci-upstream-net-kasan-gce
2017/11/29 06:52 net-next-old 1d3b78bbc6e9 29b0fd90 .config console log report ci-upstream-net-kasan-gce
2017/11/29 05:24 net-next-old 1d3b78bbc6e9 29b0fd90 .config console log report ci-upstream-net-kasan-gce
2017/11/29 02:31 net-next-old 1d3b78bbc6e9 29b0fd90 .config console log report ci-upstream-net-kasan-gce
2017/11/28 21:25 net-next-old 1d3b78bbc6e9 29b0fd90 .config console log report ci-upstream-net-kasan-gce
2017/11/28 21:19 net-next-old 1d3b78bbc6e9 29b0fd90 .config console log report ci-upstream-net-kasan-gce
2017/11/28 16:05 net-next-old 1d3b78bbc6e9 29b0fd90 .config console log report ci-upstream-net-kasan-gce
2017/11/28 14:35 net-next-old 1d3b78bbc6e9 29b0fd90 .config console log report ci-upstream-net-kasan-gce
2017/11/28 13:03 net-next-old 1d3b78bbc6e9 29b0fd90 .config console log report ci-upstream-net-kasan-gce
2018/01/06 14:11 mmots 69eed2290e1d 00193447 .config console log report ci-upstream-mmots-kasan-gce
2017/12/12 11:41 mmots 82bcf1def3b5 081721ff .config console log report ci-upstream-mmots-kasan-gce
2017/12/12 10:23 mmots 82bcf1def3b5 da131727 .config console log report ci-upstream-mmots-kasan-gce
2017/12/10 00:37 mmots 82bcf1def3b5 5ad0ce95 .config console log report ci-upstream-mmots-kasan-gce
2017/12/09 17:37 mmots 82bcf1def3b5 5ad0ce95 .config console log report ci-upstream-mmots-kasan-gce
2017/12/08 11:48 linux-next ad4dac17f9d5 b0fa969c .config console log report ci-upstream-next-kasan-gce
2017/12/04 19:01 linux-next 7cc61a0a562c 48359b97 .config console log report ci-upstream-next-kasan-gce
2017/12/03 19:42 mmots 4131d5166185 29b0fd90 .config console log report ci-upstream-mmots-kasan-gce
2017/11/29 13:20 mmots a4f586bceda4 34f2c233 .config console log report ci-upstream-mmots-kasan-gce
* Struck through repros no longer work on HEAD.