WARNING in crypto_wait_for_test

From: Dmitry Vyukov <dvyukov@google.com>
To: Herbert Xu <herbert@gondor.apana.org.au>,
	"David S. Miller" <davem@davemloft.net>,
	linux-crypto@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>
Cc: syzkaller <syzkaller@googlegroups.com>,
	Kostya Serebryany <kcc@google.com>,
	Alexander Potapenko <glider@google.com>,
	Sasha Levin <sasha.levin@oracle.com>
Subject: WARNING in crypto_wait_for_test
Date: Tue, 8 Dec 2015 12:12:27 +0100	[thread overview]
Message-ID: <CACT4Y+bws9Scv7o3AB2wPM0ZJAeDvO+kZ45h-p5viDk9ZAe9KQ@mail.gmail.com> (raw)

Hello,

The following program triggers a WARNING in crypto_wait_for_test:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <syscall.h>
#include <string.h>
#include <stdint.h>

int main()
{
        long r0 = syscall(SYS_mmap, 0x20000000ul, 0x1000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul);
        long r1 = syscall(SYS_socket, 0x26ul, 0x5ul, 0x0ul, 0, 0, 0);
        *(uint16_t*)0x20000000 = 0x26;
        memcpy((void*)0x20000002,
"\x73\x6b\x63\x69\x70\x68\x65\x72\x00\x00\x00\x00\x00\x00", 14);
        *(uint32_t*)0x20000010 = 0x1008;
        *(uint32_t*)0x20000014 = 0x469b167b45d89a6;
        memcpy((void*)0x20000018,
"\x63\x74\x72\x28\x64\x65\x73\x33\x5f\x65\x64\x65\x29\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
64);
        long r7 = syscall(SYS_bind, r1, 0x20000000ul, 0x58ul, 0, 0, 0);
        return 0;
}

------------[ cut here ]------------
WARNING: CPU: 1 PID: 11087 at crypto/algapi.c:343
crypto_wait_for_test+0xc4/0xf0()
Modules linked in:
CPU: 1 PID: 11087 Comm: a.out Tainted: G        W       4.4.0-rc3+ #151
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 0000000000000001 ffff88006ca07a78 ffffffff82e0f4b8 0000000041b58ab3
 ffffffff87a9a265 ffffffff82e0f406 ffff88003711e080 00000000ffffffff
 ffffffff89913aa0 0000000000000001 0000000000000001 0000000000002b4f
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82e0f4b8>] dump_stack+0xb2/0xfa lib/dump_stack.c:50
 [<ffffffff81373336>] warn_slowpath_common+0xe6/0x170 kernel/panic.c:460
 [<ffffffff81373589>] warn_slowpath_null+0x29/0x30 kernel/panic.c:493
 [<ffffffff82ba29e4>] crypto_wait_for_test+0xc4/0xf0 crypto/algapi.c:343
 [<ffffffff82ba2d20>] crypto_register_instance+0x220/0x350 crypto/algapi.c:558
 [<ffffffff82ba9564>] crypto_givcipher_default+0x4f4/0x620
crypto/ablkcipher.c:601
 [<ffffffff82ba984a>] crypto_lookup_skcipher+0x1ba/0x2f0 crypto/ablkcipher.c:658
 [<ffffffff82ba9aae>] crypto_alloc_ablkcipher+0x5e/0x1f0 crypto/ablkcipher.c:693
 [<ffffffff82d2a875>] skcipher_bind+0x25/0x30 crypto/algif_skcipher.c:754
 [<ffffffff82d28129>] alg_bind+0x1a9/0x410 crypto/af_alg.c:155
 [<ffffffff856b3a6a>] SYSC_bind+0x20a/0x2c0 net/socket.c:1383
 [<ffffffff856b70f4>] SyS_bind+0x24/0x30 net/socket.c:1369
 [<ffffffff86a89fb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
---[ end trace 49f86739a736fa2b ]---

strace:
socket(PF_ALG, SOCK_SEQPACKET, 0)       = 3
bind(3, {sa_family=AF_ALG, sa_data="skcipher\0\0\0\0\0\0"}, 88) = -1
ENOENT (No such file or directory)

On commit 31ade3b83e1821da5fbb2f11b5b3d4ab2ec39db8 (Nov 29).