From: Ard Biesheuvel <ardb@kernel.org>
To: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Dave Hansen <dave.hansen@intel.com>,
syzbot <syzbot+5d1bad8042a8f0e8117a@syzkaller.appspotmail.com>,
Borislav Petkov <bp@alien8.de>, "H. Peter Anvin" <hpa@zytor.com>,
jpa@git.mail.kapsi.fi, kan.liang@linux.intel.com,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Andy Lutomirski <luto@kernel.org>, Ingo Molnar <mingo@redhat.com>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
Thomas Gleixner <tglx@linutronix.de>, X86 ML <x86@kernel.org>
Subject: Re: [syzbot] BUG: sleeping function called from invalid context in __fdget_pos
Date: Wed, 30 Jun 2021 11:13:00 +0200 [thread overview]
Message-ID: <CAMj1kXFyJ9C4aqq9+DxOMCPOxQUApQK+Oa3V8F0H39wwoK9wxA@mail.gmail.com> (raw)
In-Reply-To: <20210630080934.GA24186@gondor.apana.org.au>
On Wed, 30 Jun 2021 at 10:10, Herbert Xu <herbert@gondor.apana.org.au> wrote:
>
> Hi Ard:
>
> On Wed, Jun 30, 2021 at 09:42:14AM +0200, Ard Biesheuvel wrote:
> >
> > > There's one suspect-looking site in xts_crypt():
> > >
> > > > kernel_fpu_begin();
> > > >
> > > > /* calculate first value of T */
> > > > aesni_enc(aes_ctx(ctx->raw_tweak_ctx), walk.iv, walk.iv);
> > > >
> > > > while (walk.nbytes > 0) {
> > > > int nbytes = walk.nbytes;
> > > >
> > > > ...
> > > >
> > > > err = skcipher_walk_done(&walk, walk.nbytes - nbytes);
> > > >
> > > > kernel_fpu_end();
> > > >
> > > > if (walk.nbytes > 0)
> > > > kernel_fpu_begin();
> > > > }
> > >
> > > I wonder if a slab allocation failure could leave us with walk.nbytes==0.
> >
> > The code is actually the other way around: kernel_fpu_end() comes
> > before the call to skcipher_walk_done().
> >
> > So IIUC, this code forces an allocation failure, and checks whether
> > the code deals with this gracefully, right?
> >
> > The skcipher walk API guarantees that walk.nbytes == 0 if an error is
> > returned, so the pairing of FPU begin/end looks correct to me. And
> > skcipher_walk_next() should not invoke anything that might sleep from
> > this particular context.
> >
> > Herbert, any ideas?
>
> xts_crypt looks buggy to me. In particular, if the second
> skcipher_walk_virt call (the one in the if clause) fails, then
> we will return without calling kernel_fpu_end.
>
> Another issue, we are not checking for errors on the first
> skcipher_walk_virt call, this may cause a double-free with
> the subsequent skcipher_walk_abort inside the if clause.
>
> With skcikpher_walk_virt, you must check for errors explicitly
> *unless* you use it in a loop construct which exits on !walk->nbytes.
>
So something like this, I suppose?
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -849,6 +849,8 @@
return -EINVAL;
err = skcipher_walk_virt(&walk, req, false);
+ if (err)
+ return err;
if (unlikely(tail > 0 && walk.nbytes < walk.total)) {
int blocks = DIV_ROUND_UP(req->cryptlen, AES_BLOCK_SIZE) - 2;
@@ -862,7 +864,10 @@
skcipher_request_set_crypt(&subreq, req->src, req->dst,
blocks * AES_BLOCK_SIZE, req->iv);
req = &subreq;
+
err = skcipher_walk_virt(&walk, req, false);
+ if (err)
+ return err;
} else {
tail = 0;
}
next prev parent reply other threads:[~2021-06-30 9:13 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-28 19:22 [syzbot] BUG: sleeping function called from invalid context in __fdget_pos syzbot
2021-06-29 14:46 ` Dave Hansen
2021-06-30 7:42 ` Ard Biesheuvel
2021-06-30 8:09 ` Herbert Xu
2021-06-30 9:13 ` Ard Biesheuvel [this message]
2021-06-30 12:04 ` Herbert Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAMj1kXFyJ9C4aqq9+DxOMCPOxQUApQK+Oa3V8F0H39wwoK9wxA@mail.gmail.com \
--to=ardb@kernel.org \
--cc=bp@alien8.de \
--cc=dave.hansen@intel.com \
--cc=herbert@gondor.apana.org.au \
--cc=hpa@zytor.com \
--cc=jpa@git.mail.kapsi.fi \
--cc=kan.liang@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=syzbot+5d1bad8042a8f0e8117a@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).