syzbot


general protection fault in crypto_destroy_tfm

Status: fixed on 2021/11/10 00:50
Reported-by: syzbot+12cf5fbfdeba210a89dd@syzkaller.appspotmail.com
Fix commit: 83681f2bebb3 crypto: api - check for ERR pointers in crypto_destroy_tfm()
First crash: 577d, last: 532d

Cause bisection: introduced by (bisect log) [no-op commit]:
commit c453312857ba41129db3558f5428405bbbb8f1a4
Author: Russell King <rmk+kernel@armlinux.org.uk>
Date: Mon Dec 9 11:17:30 2019 +0000

  ARM: net: bpf: Improve prologue code sequence

Crash: general protection fault in crypto_destroy_tfm (log)
Repro: syz .config
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 general protection fault in crypto_destroy_tfm syz done 12 531d 576d 1/1 fixed on 2021/05/11 18:37

Sample crash report:
general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 PID: 9811 Comm: syz-executor.1 Not tainted 5.11.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:crypto_destroy_tfm+0x38/0x210 crypto/api.c:568
Code: f5 53 e8 8b 34 dd fd 4d 85 ed 0f 84 a2 00 00 00 e8 7d 34 dd fd 4c 8d 75 10 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 8c 01 00 00 4c 8d 7d 08 4c 8b 65 10 48 b8 00 00
RSP: 0018:ffffc9000a3ef360 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff839619b3 RDI: fffffffffffffffe
RBP: 0000000000000006 R08: fffffffffffff000 R09: ffffffff8faaf8c7
R10: ffffffff8893568e R11: 0000000000000000 R12: ffff88801314d600
R13: fffffffffffffffe R14: 0000000000000016 R15: fffffffffffffffe
FS:  00007f03816c5700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559dacd630c0 CR3: 000000002bdcc000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 crypto_free_aead include/crypto/aead.h:191 [inline]
 llsec_key_alloc net/mac802154/llsec.c:156 [inline]
 mac802154_llsec_key_add+0x9e0/0xcc0 net/mac802154/llsec.c:249
 ieee802154_add_llsec_key+0x56/0x80 net/mac802154/cfg.c:338
 rdev_add_llsec_key net/ieee802154/rdev-ops.h:260 [inline]
 nl802154_add_llsec_key+0x3d3/0x560 net/ieee802154/nl802154.c:1584
 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2437
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x465f69
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f03816c5188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056c0b0 RCX: 0000000000465f69
RDX: 0000000000000000 RSI: 00000000200004c0 RDI: 0000000000000005
RBP: 00000000004bfa67 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c0b0
R13: 00007ffe1730343f R14: 00007f03816c5300 R15: 0000000000022000
Modules linked in:
---[ end trace 4215c40ea5be91ac ]---
RIP: 0010:crypto_destroy_tfm+0x38/0x210 crypto/api.c:568
Code: f5 53 e8 8b 34 dd fd 4d 85 ed 0f 84 a2 00 00 00 e8 7d 34 dd fd 4c 8d 75 10 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <80> 3c 02 00 0f 85 8c 01 00 00 4c 8d 7d 08 4c 8b 65 10 48 b8 00 00
RSP: 0018:ffffc9000a3ef360 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff839619b3 RDI: fffffffffffffffe
RBP: 0000000000000006 R08: fffffffffffff000 R09: ffffffff8faaf8c7
R10: ffffffff8893568e R11: 0000000000000000 R12: ffff88801314d600
R13: fffffffffffffffe R14: 0000000000000016 R15: fffffffffffffffe
FS:  00007f03816c5700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559dacd630c0 CR3: 000000002bdcc000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (57):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-net-this-kasan-gce 2021/03/05 00:42 net d93ef301644e 9d751681 .config log report syz general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/03/04 04:31 net-next d310ec03a34e 06ed56cd .config log report syz general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-selinux-root 2021/04/09 19:53 upstream 17e7124aad76 6a81331a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-root 2021/04/09 02:38 upstream 4fa56ad0d12e 6a81331a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-selinux-root 2021/04/08 12:58 upstream 454859c552da 6a81331a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-root 2021/04/08 02:01 upstream 3a22981230f9 6a81331a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/04/07 03:35 upstream 2d743660786e 6a81331a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/04/07 02:11 upstream 2d743660786e 6a81331a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-selinux-root 2021/04/06 03:12 upstream 0a50438c8436 6a81331a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/03/21 06:24 upstream 812da4d39463 17810eae .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/03/21 03:36 upstream 812da4d39463 17810eae .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/03/20 07:40 upstream 1c273e10bc0c 3d01c4de .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/03/17 10:10 upstream 1df27313f50a fdb2bb2c .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/03/13 23:26 upstream f296bfd5cd04 4a003785 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/03/11 12:24 upstream a74e6a014c9d c2ca1f2a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/03/09 23:34 upstream 144c79ef3353 26967e35 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-selinux-root 2021/03/09 03:47 upstream 144c79ef3353 09fbf400 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/03/08 18:39 upstream 144c79ef3353 09fbf400 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/03/08 18:09 upstream 144c79ef3353 09fbf400 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-selinux-root 2021/03/08 13:40 upstream 144c79ef3353 09fbf400 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/03/06 12:05 upstream a38fd8748464 e4b4d570 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-selinux-root 2021/03/05 13:23 upstream 280d542f6ffa 9d751681 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/03/05 12:50 upstream 280d542f6ffa 9d751681 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-selinux-root 2021/03/04 11:03 upstream f69d02e37a85 d7e4e604 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-selinux-root 2021/03/03 15:27 upstream f69d02e37a85 e5b64d68 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-root 2021/03/01 17:32 upstream fe07bfda2fb9 4c37c133 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-kasan-gce-smack-root 2021/02/25 16:50 upstream 29c395c77a9a 76f7fc95 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-this-kasan-gce 2021/03/29 22:17 net fb6ec87f7229 6a81331a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-this-kasan-gce 2021/03/29 07:17 net 1b479fb80160 a8529b82 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-this-kasan-gce 2021/03/24 21:25 net 6f235a69e594 607e3baf .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-this-kasan-gce 2021/03/09 15:15 net 4416e98594dc 09fbf400 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-this-kasan-gce 2021/03/04 22:49 net d93ef301644e 9d751681 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-this-kasan-gce 2021/03/04 20:34 net a9ecb0cbf037 9d751681 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-this-kasan-gce 2021/03/04 09:02 net a9ecb0cbf037 d7e4e604 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-this-kasan-gce 2021/03/03 16:31 net 95b39f07a17f 06ed56cd .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-this-kasan-gce 2021/03/01 12:11 net 447621e373bd 4c37c133 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-this-kasan-gce 2021/02/25 15:19 net 8f1c0fd2c84c 76f7fc95 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-this-kasan-gce 2021/02/25 13:49 net 8f1c0fd2c84c fcc6d71b .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/04/10 00:01 net-next 4438669eb703 6a81331a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/04/09 09:48 net-next 4438669eb703 6a81331a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/03/20 13:37 net-next d773b7957e4f 17810eae .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/03/19 08:56 net-next 31222162557c 380dcc3e .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/03/16 04:33 net-next 0f13b5e6bf28 fdb2bb2c .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/03/09 15:39 net-next d310ec03a34e 09fbf400 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/03/05 21:50 net-next d310ec03a34e 56722561 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/03/05 21:30 net-next d310ec03a34e 56722561 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/03/04 11:22 net-next d310ec03a34e d7e4e604 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/03/04 04:14 net-next d310ec03a34e 06ed56cd .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/03/01 20:51 net-next d310ec03a34e 183afb6c .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/02/26 12:51 net-next d310ec03a34e 76f7fc95 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/02/24 00:02 net-next d310ec03a34e fcc6d71b .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-net-kasan-gce 2021/02/23 23:27 net-next d310ec03a34e fcc6d71b .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-linux-next-kasan-gce-root 2021/03/11 10:13 linux-next b01d57bfdc41 c2ca1f2a .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-linux-next-kasan-gce-root 2021/03/11 03:26 linux-next b01d57bfdc41 764067f3 .config log report info general protection fault in crypto_destroy_tfm
ci-upstream-linux-next-kasan-gce-root 2021/03/09 14:52 linux-next 3aa6f5082286 09fbf400 .config log report info general protection fault in crypto_destroy_tfm
* Struck through repros no longer work on HEAD.