syzbot


general protection fault in blkcipher_walk_first

Status: fixed on 2018/01/03 02:35
Subsystems: crypto
[Documentation on labels]
Fix commit: 11edb555966e crypto: af_alg - wait for data at beginning of recvmsg
First crash: 2341d, last: 2330d

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 3799 Comm: syzkaller676233 Not tainted 4.15.0-rc3+ #217
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:86 [inline]
RIP: 0010:blkcipher_walk_first+0x17a/0x570 crypto/blkcipher.c:342
RSP: 0018:ffff8801c24df700 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8801c24df8e8 RCX: ffffffff82264761
RDX: 0000000000000001 RSI: 1ffff1003849bf09 RDI: 0000000000000008
RBP: ffff8801c24df748 R08: 0000000000000000 R09: ffff8801c321fb10
R10: ffff8801c24df8b8 R11: ffffed0038643f69 R12: 0000000000000000
R13: ffff8801c24df848 R14: 0000000000000010 R15: ffff8801c24df7d0
FS:  00007f17ddf3e700(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f17de73ee78 CR3: 00000001c4a6b000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 blkcipher_walk_virt+0x219/0x2a0 crypto/blkcipher.c:308
 skcipher_null_crypt+0x10e/0x2d0 crypto/crypto_null.c:85
 skcipher_crypt_blkcipher crypto/skcipher.c:622 [inline]
 skcipher_encrypt_blkcipher+0x213/0x310 crypto/skcipher.c:631
 crypto_skcipher_encrypt include/crypto/skcipher.h:445 [inline]
 crypto_aead_copy_sgl crypto/algif_aead.c:90 [inline]
 _aead_recvmsg crypto/algif_aead.c:243 [inline]
 aead_recvmsg+0x7ed/0x1bc0 crypto/algif_aead.c:329
 sock_recvmsg_nosec net/socket.c:809 [inline]
 sock_recvmsg+0xc9/0x110 net/socket.c:816
 ___sys_recvmsg+0x29b/0x630 net/socket.c:2185
 __sys_recvmsg+0xe2/0x210 net/socket.c:2230
 SYSC_recvmsg net/socket.c:2242 [inline]
 SyS_recvmsg+0x2d/0x50 net/socket.c:2237
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x446339
RSP: 002b:00007f17ddf3ddc8 EFLAGS: 00000202 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000446339
RDX: 0000000000002002 RSI: 0000000020fd9fc8 RDI: 0000000000000015
RBP: 0000000000000000 R08: 00007f17ddf3e700 R09: 00007f17ddf3e700
R10: 00007f17ddf3e700 R11: 0000000000000202 R12: 0000000000000000
R13: 00007ffcbcb68e2f R14: 00007f17ddf3e9c0 R15: 0000000000000000
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 a7 03 00 00 4d 8b 67 20 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 08 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 18 03 00 00 49 8d 7f 28 48 
RIP: scatterwalk_start include/crypto/scatterwalk.h:86 [inline] RSP: ffff8801c24df700
RIP: blkcipher_walk_first+0x17a/0x570 crypto/blkcipher.c:342 RSP: ffff8801c24df700
---[ end trace 93fe6f459b527e28 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/12/11 18:50 upstream 50c4c4e268a2 27f5dfef .config console log report syz C ci-upstream-kasan-gce
2017/12/11 18:33 net-next-old a0b586fa75a6 27f5dfef .config console log report syz C ci-upstream-net-kasan-gce
2017/12/13 21:39 mmots 82bcf1def3b5 06ea774d .config console log report syz C ci-upstream-mmots-kasan-gce
2017/12/11 18:52 linux-next 153e8244ebcb 27f5dfef .config console log report syz C ci-upstream-next-kasan-gce
2017/12/22 16:48 net-next-old 0a80f0c26bf5 81fe66b4 .config console log report ci-upstream-net-kasan-gce
2017/12/12 08:02 net-next-old a0b586fa75a6 da131727 .config console log report ci-upstream-net-kasan-gce
2017/12/11 18:04 net-next-old a0b586fa75a6 27f5dfef .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.