syzbot


general protection fault in crypto_chacha20_crypt

Status: fixed on 2018/01/03 02:35
Subsystems: crypto
[Documentation on labels]
Reported-by: syzbot+fa2ed481fed0c7ace1571b88a89dfd49ffd89cb6@syzkaller.appspotmail.com
Fix commit: 2b4f27c36bcd crypto: skcipher - set walk.iv for zero-length inputs
First crash: 2576d, last: 2541d
Duplicate bugs (4)
duplicates (4):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
BUG: unable to handle kernel paging request in crypto_chacha20_crypt crypto C 24 2552d 2567d 0/28 closed as dup on 2017/12/03 19:11
KASAN: use-after-free Read in crypto_chacha20_crypt crypto C 81 2547d 2572d 0/28 closed as dup on 2017/11/29 08:57
KASAN: stack-out-of-bounds Read in crypto_chacha20_crypt crypto 644 2541d 2571d 0/28 closed as dup on 2017/11/29 08:58
KASAN: slab-out-of-bounds Read in crypto_chacha20_crypt crypto 2 2552d 2570d 0/28 closed as dup on 2017/11/30 09:01

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 4253 Comm: syzkaller254960 Not tainted 4.15.0-rc4+ #227
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__le32_to_cpup include/uapi/linux/byteorder/little_endian.h:58 [inline]
RIP: 0010:le32_to_cpuvp crypto/chacha20_generic.c:19 [inline]
RIP: 0010:crypto_chacha20_init crypto/chacha20_generic.c:58 [inline]
RIP: 0010:crypto_chacha20_crypt+0x537/0xbd0 crypto/chacha20_generic.c:91
RSP: 0018:ffff8801c49ff4a0 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 00000000e6000000 RCX: ffffffff8226421b
RDX: 0000000000000000 RSI: ffff8801c41dbe40 RDI: ffff8801c49ff53c
RBP: ffff8801c49ff6c0 R08: ffffed003978202c R09: ffff8801cbc10140
R10: ffff8801c49ff6e0 R11: ffffed003978202b R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: dffffc0000000000
FS:  00000000020b6880(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f972ed02000 CR3: 00000001c4728001 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 chacha20_simd+0xe4/0x410 arch/x86/crypto/chacha20_glue.c:78
 crypto_skcipher_decrypt include/crypto/skcipher.h:463 [inline]
 _skcipher_recvmsg crypto/algif_skcipher.c:126 [inline]
 skcipher_recvmsg+0x733/0xf10 crypto/algif_skcipher.c:165
 sock_recvmsg_nosec net/socket.c:809 [inline]
 sock_recvmsg+0xc9/0x110 net/socket.c:816
 sock_read_iter+0x35b/0x560 net/socket.c:893
 call_read_iter include/linux/fs.h:1766 [inline]
 aio_read+0x2aa/0x3a0 fs/aio.c:1501
 io_submit_one fs/aio.c:1611 [inline]
 do_io_submit+0xf8d/0x14f0 fs/aio.c:1682
 SYSC_io_submit fs/aio.c:1707 [inline]
 SyS_io_submit+0x27/0x30 fs/aio.c:1704
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x440919
RSP: 002b:00007ffd91397ae8 EFLAGS: 00000213 ORIG_RAX: 00000000000000d1
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440919
RDX: 0000000020738000 RSI: 0000000000000001 RDI: 00007f972ed02000
RBP: 00000000000063e8 R08: 0000000000000000 R09: 0000000000000005
R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000000000
R13: 0000000000401da0 R14: 0000000000000000 R15: 0000000000000000
Code: 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 d6 05 00 00 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 89 9d 7c fe ff ff 48 c1 ea 03 <0f> b6 14 02 4c 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 
RIP: __le32_to_cpup include/uapi/linux/byteorder/little_endian.h:58 [inline] RSP: ffff8801c49ff4a0
RIP: le32_to_cpuvp crypto/chacha20_generic.c:19 [inline] RSP: ffff8801c49ff4a0
RIP: crypto_chacha20_init crypto/chacha20_generic.c:58 [inline] RSP: ffff8801c49ff4a0
RIP: crypto_chacha20_crypt+0x537/0xbd0 crypto/chacha20_generic.c:91 RSP: ffff8801c49ff4a0
---[ end trace f6c022a06f21d721 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (2374):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/12/18 21:24 upstream 1291a0d5049d 1c4160ef .config console log report syz C ci-upstream-kasan-gce
2017/12/11 11:44 upstream 50c4c4e268a2 5ad0ce95 .config console log report syz C ci-upstream-kasan-gce
2017/11/24 17:29 net-next-old 1d3b78bbc6e9 deb5f6ae .config console log report syz C ci-upstream-kasan-gce
2017/11/24 17:04 net-next-old 1d3b78bbc6e9 deb5f6ae .config console log report syz C ci-upstream-kasan-gce
2017/11/24 18:53 net-next-old 0c86a6bd85ff ddf7b3e0 .config console log report syz C ci-upstream-net-kasan-gce
2017/11/24 18:37 net-next-old 0c86a6bd85ff ddf7b3e0 .config console log report syz C ci-upstream-net-kasan-gce
2017/12/19 19:20 mmots 82bcf1def3b5 af9163c7 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/12/19 17:36 mmots 82bcf1def3b5 af9163c7 .config console log report syz C ci-upstream-mmots-kasan-gce
2017/12/18 20:43 mmots 82bcf1def3b5 1c4160ef .config console log report syz C ci-upstream-mmots-kasan-gce
2017/12/14 10:54 mmots 82bcf1def3b5 ac20b98c .config console log report syz C ci-upstream-mmots-kasan-gce
2017/12/13 19:51 mmots 82bcf1def3b5 06ea774d .config console log report syz C ci-upstream-mmots-kasan-gce
2017/12/11 12:14 linux-next 153e8244ebcb 5ad0ce95 .config console log report syz C ci-upstream-next-kasan-gce
2017/11/24 18:01 mmots 1ea8d039f9ed deb5f6ae .config console log report syz C ci-upstream-mmots-kasan-gce
2017/11/24 17:33 linux-next 6fc478f80f68 4bd70f88 .config console log report syz C ci-upstream-next-kasan-gce
2017/12/29 20:21 net-next-old d367341b25bd 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/29 17:07 net-next-old d367341b25bd 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/29 08:04 net-next-old d367341b25bd 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/29 04:27 net-next-old d367341b25bd 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/29 03:16 net-next-old d367341b25bd 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/29 01:12 net-next-old 836df24a7062 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/28 16:05 net-next-old 836df24a7062 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/28 11:08 net-next-old 55b07a65e15b 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/28 08:38 net-next-old 55b07a65e15b 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/28 07:07 net-next-old 55b07a65e15b 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/28 03:50 net-next-old 55b07a65e15b 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/28 02:43 net-next-old 55b07a65e15b 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/28 00:19 net-next-old 55b07a65e15b 7d240098 .config console log report ci-upstream-net-kasan-gce
2017/12/27 20:02 net-next-old 214bb1c78a4d 09c8f4c0 .config console log report ci-upstream-net-kasan-gce
2017/12/27 18:11 net-next-old 214bb1c78a4d 09c8f4c0 .config console log report ci-upstream-net-kasan-gce
2017/12/27 16:46 net-next-old 214bb1c78a4d 09c8f4c0 .config console log report ci-upstream-net-kasan-gce
2017/12/27 10:44 net-next-old 214bb1c78a4d 09c8f4c0 .config console log report ci-upstream-net-kasan-gce
2017/12/27 08:42 net-next-old 214bb1c78a4d 09c8f4c0 .config console log report ci-upstream-net-kasan-gce
2017/12/27 07:33 net-next-old 214bb1c78a4d 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/27 04:41 net-next-old 243dc5fb4697 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/27 03:33 net-next-old 243dc5fb4697 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/27 01:34 net-next-old 243dc5fb4697 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/26 23:32 net-next-old 243dc5fb4697 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/26 21:32 net-next-old 243dc5fb4697 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/26 19:19 net-next-old 243dc5fb4697 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/26 15:59 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/26 13:28 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/26 07:29 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/26 05:05 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/26 03:17 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/26 01:10 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/25 20:31 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/25 17:50 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/25 15:40 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/25 11:41 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/25 05:52 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/25 01:02 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/24 19:46 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/24 15:05 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
2017/12/24 12:00 net-next-old fba961ab29e5 73aba437 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.