Re: WARNING: suspicious RCU usage in tipc_bearer_find

2018-05-13 Thread Eric Biggers
On Fri, Feb 09, 2018 at 12:00:01PM -0800, syzbot wrote: > syzbot has found reproducer for the following crash on net-next commit > 617aebe6a97efa539cc4b8a52adccd89596e6be0 (Sun Feb 4 00:25:42 2018 +) > Merge tag 'usercopy-v4.16-rc1' of > git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Re: KASAN: use-after-free Read in remove_wait_queue (2)

2018-05-13 Thread Eric Biggers
[+ppp list and maintainer] On Wed, Feb 28, 2018 at 08:59:02AM -0800, syzbot wrote: > Hello, > > syzbot hit the following crash on upstream commit > f3afe530d644488a074291da04a69a296ab63046 (Tue Feb 27 22:02:39 2018 +) > Merge branch 'fixes-v4.16-rc4' of > git://git.kernel.org/pub/scm/linux/ke

Re: KASAN: use-after-free Read in remove_wait_queue (2)

2018-05-22 Thread Eric Biggers
On Fri, May 18, 2018 at 06:02:23PM +0200, Guillaume Nault wrote: > On Sun, May 13, 2018 at 11:11:55PM -0700, Eric Biggers wrote: > > [+ppp list and maintainer] > > > > This is a bug in ppp_generic.c; it still happens on Linus' tree and it's > > easily >

[PATCH] ppp: remove the PPPIOCDETACH ioctl

2018-05-22 Thread Eric Biggers
From: Eric Biggers The PPPIOCDETACH ioctl effectively tries to "close" the given ppp file before f_count has reached 0, which is fundamentally a bad idea. It does check 'f_count < 2', which excludes concurrent operations on the file since they would only be possible wit

Re: BUG: unable to handle kernel NULL pointer dereference

2017-12-03 Thread Eric Biggers
On Sun, Dec 03, 2017 at 04:37:01AM -0800, syzbot wrote: > BUG: KASAN: use-after-free in skcipher_request_set_tfm > include/crypto/skcipher.h:499 [inline] > BUG: KASAN: use-after-free in crypto_aead_copy_sgl crypto/algif_aead.c:85 > [inline] > BUG: KASAN: use-after-free in _aead_recvmsg crypto/algif

Re: kernel BUG at net/key/af_key.c:LINE!

2017-12-03 Thread Eric Biggers
On Wed, Nov 15, 2017 at 12:29:19PM +0100, Steffen Klassert wrote: > On Fri, Nov 10, 2017 at 02:14:06PM +1100, Herbert Xu wrote: > > On Fri, Nov 10, 2017 at 01:30:38PM +1100, Herbert Xu wrote: > > > > > > I found the problem. This crap is coming from clone_policy. Now > > > let me where this code

Re: [PATCH] net: phy: mscc: avoid skcipher API for single block AES encryption

2020-06-24 Thread Eric Biggers
ret = aes_expandkey(&ctx, key, key_len); > + if (ret) > + return ret; > > -out: > - skcipher_request_free(req); > - crypto_free_skcipher(tfm); > - return ret; > + aes_encrypt(&ctx, hkey, input); > + memzero_explicit(&ctx, sizeof(ctx)); > + return 0; > } > Otherwise this looks good. You can add: Reviewed-by: Eric Biggers - Eric

[PATCH net] esp: select CRYPTO_SEQIV

2020-06-04 Thread Eric Biggers
From: Eric Biggers Since CRYPTO_CTR no longer selects CRYPTO_SEQIV, it should be selected by INET_ESP and INET6_ESP -- similar to CRYPTO_ECHAINIV. Fixes: f23efcbcc523 ("crypto: ctr - no longer needs CRYPTO_SEQIV") Cc: Corentin Labbe Cc: Greg Kroah-Hartman Cc: Herbert Xu Cc: Steffe

Re: BUG: sleeping function called from invalid context in crypto_drop_spawn

2020-06-04 Thread Eric Biggers
+Cc linux-crypto. crypto_free_shash() is being called in atomic context; perhaps that should be allowed? kfree() can be called in atomic context. On Thu, Jun 04, 2020 at 05:33:19PM -0700, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit:39884604 mptcp: fix NU

Re: BUG: using smp_processor_id() in preemptible code in radix_tree_node_alloc

2020-06-04 Thread Eric Biggers
[+Cc Matthew Wilcox] Possibly a bug in lib/radix-tree.c? this_cpu_ptr() in radix_tree_node_alloc() can be reached without a prior preempt_disable(). Or is the caller of idr_alloc() doing something wrong? On Thu, Jun 04, 2020 at 07:02:18PM -0700, syzbot wrote: > Hello, > > syzbot found the foll

Re: BUG: using smp_processor_id() in preemptible code in debug_smp_processor_id

2020-06-04 Thread Eric Biggers
On Thu, Jun 04, 2020 at 07:42:18AM -0700, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit:065fcfd4 selftests: net: ip_defrag: ignore EPERM > git tree: net-next > console output: https://syzkaller.appspot.com/x/log.txt?x=15c3e51610 > kernel config: ht

Re: general protection fault in kobject_get (2)

2020-06-04 Thread Eric Biggers
On Wed, May 20, 2020 at 07:56:41AM +0200, Greg KH wrote: > On Tue, May 19, 2020 at 09:53:16PM -0700, syzbot wrote: > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit:d00f26b6 Merge git://git.kernel.org/pub/scm/linux/kernel/g.. > > git tree: net-next > > console

Re: [PATCH net] esp: select CRYPTO_SEQIV

2020-06-04 Thread Eric Biggers
On Fri, Jun 05, 2020 at 10:29:56AM +1000, Herbert Xu wrote: > On Fri, Jun 05, 2020 at 10:28:58AM +1000, Herbert Xu wrote: > > > > Hmm, the selection list doesn't include CTR so just adding SEQIV > > per se makes no sense. I'm not certain that we really want to > > include every algorithm under the

Re: BUG: using smp_processor_id() in preemptible code in radix_tree_node_alloc

2020-06-05 Thread Eric Biggers
On Fri, Jun 05, 2020 at 04:29:22AM -0700, Matthew Wilcox wrote: > On Thu, Jun 04, 2020 at 08:55:55PM -0700, Eric Biggers wrote: > > Possibly a bug in lib/radix-tree.c? this_cpu_ptr() in > > radix_tree_node_alloc() > > can be reached without a prior preempt_disable().

Re: [PATCH] qrtr: Convert qrtr_ports from IDR to XArray

2020-06-05 Thread Eric Biggers
On Fri, Jun 05, 2020 at 05:00:37AM -0700, Matthew Wilcox wrote: > From: "Matthew Wilcox (Oracle)" > > The XArray interface is easier for this driver to use. Also fixes a > bug reported by the improper use of GFP_ATOMIC. > > Signed-off-by: Matthew Wilcox (Oracle) This fixes https://lkml.kernel

[PATCH net v2] esp: select CRYPTO_SEQIV when useful

2020-06-05 Thread Eric Biggers
From: Eric Biggers CRYPTO_CTR no longer selects CRYPTO_SEQIV, which breaks IPsec for users who need any of the algorithms that use seqiv. These users now would need to explicitly enable CRYPTO_SEQIV. There doesn't seem to be a clear rule on what algorithms the IPsec options (INET_ES

Re: [PATCH net v2] esp: select CRYPTO_SEQIV when useful

2020-06-05 Thread Eric Biggers
On Fri, Jun 05, 2020 at 10:39:31AM -0700, Eric Biggers wrote: > From: Eric Biggers > > CRYPTO_CTR no longer selects CRYPTO_SEQIV, which breaks IPsec for users > who need any of the algorithms that use seqiv. These users now would > need to explicitly enable CRYPTO_SEQIV. > &g

Re: [RFC PATCH 4/7] crypto: remove ARC4 support from the skcipher API

2020-07-02 Thread Eric Biggers
[+linux-wireless, Marcel Holtmann, and Denis Kenzior] On Thu, Jul 02, 2020 at 12:19:44PM +0200, Ard Biesheuvel wrote: > Remove the generic ecb(arc4) skcipher, which is slightly cumbersome from > a maintenance perspective, since it does not quite behave like other > skciphers do in terms of key vs

[PATCH net v2] isdn/capi: check message length in capi_write()

2019-09-05 Thread Eric Biggers
From: Eric Biggers syzbot reported: BUG: KMSAN: uninit-value in capi_write+0x791/0xa90 drivers/isdn/capi/capi.c:700 CPU: 0 PID: 10025 Comm: syz-executor379 Not tainted 4.20.0-rc7+ #2 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call

[PATCH net v3 0/3] esp, ah: improve crypto algorithm selections

2020-06-09 Thread Eric Biggers
...@kernel.org/T/#u Eric Biggers (3): esp, ah: consolidate the crypto algorithm selections esp: select CRYPTO_SEQIV esp, ah: modernize the crypto algorithm selections net/ipv4/Kconfig | 37 + net/ipv6/Kconfig | 37 + net/xfrm

[PATCH net v3 3/3] esp, ah: modernize the crypto algorithm selections

2020-06-09 Thread Eric Biggers
From: Eric Biggers The crypto algorithms selected by the ESP and AH kconfig options are out-of-date with the guidance of RFC 8221, which lists the legacy algorithms MD5 and DES as "MUST NOT" be implemented, and some more modern algorithms like AES-GCM and HMAC-SHA256 as "MUST&

[PATCH net v3 2/3] esp: select CRYPTO_SEQIV

2020-06-09 Thread Eric Biggers
From: Eric Biggers Commit f23efcbcc523 ("crypto: ctr - no longer needs CRYPTO_SEQIV") made CRYPTO_CTR stop selecting CRYPTO_SEQIV. This breaks IPsec for most users since GCM and several other encryption algorithms require "seqiv" -- and RFC 8221 lists AES-GCM as "MU

[PATCH net v3 1/3] esp, ah: consolidate the crypto algorithm selections

2020-06-09 Thread Eric Biggers
From: Eric Biggers Instead of duplicating the algorithm selections between INET_AH and INET6_AH and between INET_ESP and INET6_ESP, create new tristates XFRM_AH and XFRM_ESP that do the algorithm selections, and make these be selected by the corresponding INET* options. Suggested-by: Herbert Xu

Re: [PATCH net v3 3/3] esp, ah: modernize the crypto algorithm selections

2020-06-10 Thread Eric Biggers
On Wed, Jun 10, 2020 at 11:03:55AM +0200, Tobias Brunner wrote: > Hi Eric, > > > + Note that RFC 8221 considers AH itself to be "NOT RECOMMENDED". It is > > + better to use ESP only, using an AEAD cipher such as AES-GCM. > > What's NOT RECOMMENDED according to the RFC is the combination

[PATCH net v4 0/3] esp, ah: improve crypto algorithm selections

2020-06-10 Thread Eric Biggers
...@kernel.org/T/#u Changed v3 => v4: - Don't say that AH is "NOT RECOMMENDED" by RFC 8221. - Updated commit messages (added Acked-by tags, fixed a bad Fixes tag, added some more explanation to patch 3). Eric Biggers (3): esp, ah: consolidate the crypto algorithm select

[PATCH net v4 1/3] esp, ah: consolidate the crypto algorithm selections

2020-06-10 Thread Eric Biggers
From: Eric Biggers Instead of duplicating the algorithm selections between INET_AH and INET6_AH and between INET_ESP and INET6_ESP, create new tristates XFRM_AH and XFRM_ESP that do the algorithm selections, and make these be selected by the corresponding INET* options. Suggested-by: Herbert Xu

[PATCH net v4 2/3] esp: select CRYPTO_SEQIV

2020-06-10 Thread Eric Biggers
From: Eric Biggers Commit f23efcbcc523 ("crypto: ctr - no longer needs CRYPTO_SEQIV") made CRYPTO_CTR stop selecting CRYPTO_SEQIV. This breaks IPsec for most users since GCM and several other encryption algorithms require "seqiv" -- and RFC 8221 lists AES-GCM as "MU

[PATCH net v4 3/3] esp, ah: modernize the crypto algorithm selections

2020-06-10 Thread Eric Biggers
From: Eric Biggers The crypto algorithms selected by the ESP and AH kconfig options are out-of-date with the guidance of RFC 8221, which lists the legacy algorithms MD5 and DES as "MUST NOT" be implemented, and some more modern algorithms like AES-GCM and HMAC-SHA256 as "MUST&

[PATCH net v5 1/3] esp, ah: consolidate the crypto algorithm selections

2020-06-15 Thread Eric Biggers
From: Eric Biggers Instead of duplicating the algorithm selections between INET_AH and INET6_AH and between INET_ESP and INET6_ESP, create new tristates XFRM_AH and XFRM_ESP that do the algorithm selections, and make these be selected by the corresponding INET* options. Suggested-by: Herbert Xu

[PATCH net v5 3/3] esp, ah: modernize the crypto algorithm selections

2020-06-15 Thread Eric Biggers
From: Eric Biggers The crypto algorithms selected by the ESP and AH kconfig options are out-of-date with the guidance of RFC 8221, which lists the legacy algorithms MD5 and DES as "MUST NOT" be implemented, and some more modern algorithms like AES-GCM and HMAC-SHA256 as "MUST&

[PATCH net v5 0/3] esp, ah: improve crypto algorithm selections

2020-06-15 Thread Eric Biggers
d commit messages (added Acked-by tags, fixed a bad Fixes tag, added some more explanation to patch 3). Eric Biggers (3): esp, ah: consolidate the crypto algorithm selections esp: select CRYPTO_SEQIV esp, ah: modernize the crypto algorithm selections net/ipv4/Kconfig | 34 ++

[PATCH net v5 2/3] esp: select CRYPTO_SEQIV

2020-06-15 Thread Eric Biggers
From: Eric Biggers Commit f23efcbcc523 ("crypto: ctr - no longer needs CRYPTO_SEQIV") made CRYPTO_CTR stop selecting CRYPTO_SEQIV. This breaks IPsec for most users since GCM and several other encryption algorithms require "seqiv" -- and RFC 8221 lists AES-GCM as "MU

Re: [PATCH v4 1/3] mm/slab: Use memzero_explicit() in kzfree()

2020-06-15 Thread Eric Biggers
On Mon, Jun 15, 2020 at 09:57:16PM -0400, Waiman Long wrote: > The kzfree() function is normally used to clear some sensitive > information, like encryption keys, in the buffer before freeing it back > to the pool. Memset() is currently used for the buffer clearing. However, > it is entirely possib

Re: [PATCH net v5 0/3] esp, ah: improve crypto algorithm selections

2020-06-16 Thread Eric Biggers
On Tue, Jun 16, 2020 at 08:02:58AM +0200, Steffen Klassert wrote: > On Mon, Jun 15, 2020 at 03:13:15PM -0700, Eric Biggers wrote: > > This series consolidates and modernizes the lists of crypto algorithms > > that are selected by the IPsec kconfig options, and adds CRYPTO_SEQIV

[PATCH] libceph: don't WARN() if user tries to add invalid key

2017-11-06 Thread Eric Biggers
From: Eric Biggers The WARN_ON(!key->len) in set_secret() in net/ceph/crypto.c is hit if a user tries to add a key of type "ceph" with an invalid payload as follows (assuming CONFIG_CEPH_LIB=y): echo -e -n '\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' \

Re: [PATCH v3 net-next 3/4] tls: kernel TLS support

2017-07-11 Thread Eric Biggers
On Tue, Jul 11, 2017 at 11:53:11AM -0700, Dave Watson wrote: > On 07/11/17 08:29 AM, Steffen Klassert wrote: > > Sorry for replying to old mail... > > > +int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx) > > > +{ > > > > ... > > > > > + > > > + if (!sw_ctx->aead_send) { > > > +

Re: [PATCH] once: switch to new jump label API

2017-09-15 Thread Eric Biggers
On Tue, Aug 22, 2017 at 02:44:41PM -0400, Hannes Frederic Sowa wrote: > Eric Biggers writes: > > > From: Eric Biggers > > > > Switch the DO_ONCE() macro from the deprecated jump label API to the new > > one. The new one is more readable, and for DO_ONCE() it als

Re: KASAN: stack-out-of-bounds Read in xfrm_state_find (3)

2017-12-12 Thread Eric Biggers
Hi Steffen, On Fri, Dec 01, 2017 at 08:27:43AM +0100, Steffen Klassert wrote: > On Wed, Nov 22, 2017 at 08:05:00AM -0800, syzbot wrote: > > syzkaller has found reproducer for the following crash on > > 0c86a6bd85ff0629cd2c5141027fc1c8bb6cde9c > > git://git.kernel.org/pub/scm/linux/kernel/git/davem

Re: [PATCH V4 1/2] ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE

2018-02-10 Thread Eric Biggers
Hi Jason, On Fri, Feb 09, 2018 at 05:45:49PM +0800, Jason Wang wrote: > To avoid slab to warn about exceeded size, fail early if queue > occupies more than KMALLOC_MAX_SIZE. > > Reported-by: syzbot+e4d4f9ddd42955397...@syzkaller.appspotmail.com > Fixes: 2e0ab8ca83c12 ("ptr_ring: array based FIFO

Re: WARNING in can_rcv

2018-01-16 Thread Eric Biggers
On Wed, Jan 17, 2018 at 07:39:24AM +0100, Oliver Hartkopp wrote: > > > On 01/16/2018 07:11 PM, Dmitry Vyukov wrote: > > On Tue, Jan 16, 2018 at 7:07 PM, Marc Kleine-Budde > > wrote: > > > On 01/16/2018 06:58 PM, syzbot wrote: > > > > Hello, > > > > > > > > syzkaller hit the following crash on

Re: dangers of bots on the mailing lists was Re: divide error in ___bpf_prog_run

2018-01-17 Thread Eric Biggers
On Wed, Jan 17, 2018 at 05:18:17PM -0800, Joe Perches wrote: > On Wed, 2018-01-17 at 20:09 -0500, Theodore Ts'o wrote: > > get_maintainer.pl, which is often not accurate > > Examples please. > Well, the primary problem is that place the crash occurs is not necessarily responsible for the bug. B

Re: general protection fault in __lock_acquire (2)

2018-01-26 Thread Eric Biggers
On Thu, Nov 02, 2017 at 03:55:00AM -0700, syzbot wrote: > Hello, > > syzkaller hit the following crash on > fa8785e862ef644f742558f1a8c91eca6f3f0004 > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: general protection fault in __rds_rdma_map

2018-01-30 Thread Eric Biggers
On Mon, Nov 27, 2017 at 10:30:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > e1d1ea549b57790a3d8cf6300e6ef86118d692a3 > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: WARNING in xfrm_state_fini

2018-01-30 Thread Eric Biggers
On Mon, Nov 27, 2017 at 09:37:07AM -0800, Cong Wang wrote: > On Mon, Nov 27, 2017 at 3:55 AM, Steffen Klassert > wrote: > > On Tue, Nov 21, 2017 at 06:44:04PM -0800, Cong Wang wrote: > >> User-space uses proto==0 as a wildcard, but xfrm_id_proto_match() > >> doesn't consider it as a match with IPS

Re: KASAN: stack-out-of-bounds Read in xfrm_state_find (3)

2018-01-30 Thread Eric Biggers
On Wed, Dec 13, 2017 at 06:18:05AM +0100, Steffen Klassert wrote: > On Tue, Dec 12, 2017 at 01:00:31PM -0800, Eric Biggers wrote: > > Hi Steffen, > > > > On Fri, Dec 01, 2017 at 08:27:43AM +0100, Steffen Klassert wrote: > > > On Wed, Nov 22, 2017 at

Re: BUG: unable to handle kernel NULL pointer dereference in addrconf_ifdown

2018-01-30 Thread Eric Biggers
On Tue, Dec 19, 2017 at 11:50:01PM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: BUG: unable to handle kernel NULL pointer dereference in sctp_cmp_addr_exact

2018-01-30 Thread Eric Biggers
On Tue, Dec 19, 2017 at 11:49:03PM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: BUG: unable to handle kernel NULL pointer dereference in addrconf_notify

2018-01-30 Thread Eric Biggers
On Tue, Dec 19, 2017 at 11:48:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: BUG: unable to handle kernel NULL pointer dereference in neigh_fill_info

2018-01-30 Thread Eric Biggers
On Tue, Dec 19, 2017 at 10:41:00AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: BUG: unable to handle kernel NULL pointer dereference in ipv6_get_lladdr

2018-01-30 Thread Eric Biggers
On Tue, Dec 19, 2017 at 08:38:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: BUG: unable to handle kernel NULL pointer dereference in qdisc_match_from_root

2018-01-30 Thread Eric Biggers
On Tue, Dec 19, 2017 at 05:43:00AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: BUG: unable to handle kernel NULL pointer dereference in tc_fill_qdisc

2018-01-30 Thread Eric Biggers
On Tue, Dec 19, 2017 at 04:49:02AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: BUG: unable to handle kernel NULL pointer dereference in ip_mc_up

2018-01-30 Thread Eric Biggers
On Tue, Dec 19, 2017 at 12:40:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: BUG: unable to handle kernel NULL pointer dereference in snmp6_unregister_dev

2018-01-30 Thread Eric Biggers
On Tue, Dec 19, 2017 at 12:35:02AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: BUG: unable to handle kernel NULL pointer dereference in inet6_fill_ifinfo

2018-01-30 Thread Eric Biggers
On Mon, Dec 18, 2017 at 11:54:00PM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: [rds-devel] BUG: unable to handle kernel NULL pointer dereference in rds_send_xmit

2018-01-30 Thread Eric Biggers
On Mon, Dec 18, 2017 at 12:22:51PM -0500, Sowmini Varadhan wrote: > > From: Santosh Shilimkar > > Date: Mon, 18 Dec 2017 08:28:05 -0800 > : > > > Looks like another one tripping on empty transport. Mostly below > > > should > > > address it but we will test it if it does. > > that was my first

Re: BUG: spinlock bad magic (2)

2018-01-30 Thread Eric Biggers
On Mon, Dec 18, 2017 at 06:01:30PM +0100, 'Dmitry Vyukov' via syzkaller-bugs wrote: > On Mon, Dec 18, 2017 at 5:46 PM, Santosh Shilimkar > wrote: > > On 12/18/2017 4:36 AM, syzbot wrote: > >> > >> Hello, > >> > >> syzkaller hit the following crash on > >> 6084b576dca2e898f5c101baef151f7bfdbb606d

Re: WARNING in inet_sock_destruct

2018-01-30 Thread Eric Biggers
On Sun, Nov 05, 2017 at 01:05:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 7f9ad2ace17a3521a80831208d431170ef71591f > git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: general protection fault in sctp_stream_free

2018-01-30 Thread Eric Biggers
On Sun, Nov 05, 2017 at 01:35:02AM -0700, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 2a171788ba7bb61995e98e8163204fc7880f63b2 > git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: BUG: unable to handle kernel NULL pointer dereference in sctp_stream_free

2018-01-30 Thread Eric Biggers
On Fri, Dec 22, 2017 at 01:31:26PM +0800, Xin Long wrote: > On Thu, Dec 21, 2017 at 9:13 PM, Marcelo Ricardo Leitner > wrote: > > On Wed, Dec 20, 2017 at 12:51:01PM -0800, syzbot wrote: > > > > from the log: > > [ 89.451366] FAULT_INJECTION: forcing a failure.^M > > [ 89.451366] name failslab,

Re: WARNING in _copy_to_user

2018-01-30 Thread Eric Biggers
On Fri, Dec 01, 2017 at 03:30:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > df8ba95c572a187ed2aa7403e97a7a7f58c01f00 > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: WARNING: bad unlock balance detected!

2018-01-30 Thread Eric Biggers
On Thu, Dec 14, 2017 at 11:37:00PM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 50c4c4e268a2d7a3e58ebb698ac74da0de40ae36 > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: WARNING: bad unlock balance in ipmr_mfc_seq_stop

2018-01-30 Thread Eric Biggers
On Fri, Dec 15, 2017 at 11:52:01PM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > a638349bf6c29433b938141f99225b160551ff48 > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: suspicious RCU usage at ./include/linux/inetdevice.h:LINE

2018-01-30 Thread Eric Biggers
On Thu, Nov 02, 2017 at 03:53:38AM -0700, syzbot wrote: > Hello, > > syzkaller hit the following crash on > ce43f4fd6f103681c7485c2b1967179647e73555 > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: general protection fault in fib6_add (2)

2018-01-30 Thread Eric Biggers
On Wed, Jan 03, 2018 at 10:53:02AM -0800, 'Wei Wang' via syzkaller-bugs wrote: > On Wed, Jan 3, 2018 at 8:16 AM, David Ahern wrote: > > [ +wei...@google.com ] > > > > On 1/2/18 3:58 PM, syzbot wrote: > >> Hello, > >> > >> syzkaller hit the following crash on > >> 61233580f1f33c50e159c50e24d80ffd2b

Re: BUG: unable to handle kernel paging request in check_memory_region

2018-01-30 Thread Eric Biggers
On Sun, Jan 14, 2018 at 01:22:13AM +0100, Daniel Borkmann wrote: > On 01/13/2018 08:29 AM, Dmitry Vyukov wrote: > > On Fri, Jan 12, 2018 at 11:58 PM, syzbot > > wrote: > >> Hello, > >> > >> syzkaller hit the following crash on > >> c92a9a461dff6140c539c61e457aa97df29517d6 > >> git://git.kernel.org

Re: KASAN: use-after-free Read in __bpf_prog_put

2018-01-30 Thread Eric Biggers
On Thu, Jan 11, 2018 at 11:48:28AM +0100, Daniel Borkmann wrote: > Hi Dmitry, > > On 01/11/2018 11:22 AM, Dmitry Vyukov wrote: > > On Thu, Jan 11, 2018 at 11:17 AM, syzbot > > wrote: > >> Hello, > >> > >> syzkaller hit the following crash on > >> 4147d50978df60f34d444c647dde9e5b34a4315e > >> git:

Re: [PATCH ipsec] xfrm: skip policies marked as dead while rehashing

2018-01-30 Thread Eric Biggers
On Sun, Dec 31, 2017 at 08:50:17AM +0100, Steffen Klassert wrote: > On Wed, Dec 27, 2017 at 11:25:45PM +0100, Florian Westphal wrote: > > syzkaller triggered following KASAN splat: > > > > BUG: KASAN: slab-out-of-bounds in xfrm_hash_rebuild+0xdbe/0xf00 > > net/xfrm/xfrm_policy.c:618 > > read of s

Re: KASAN: slab-out-of-bounds Read in xfrm_hash_rebuild

2018-01-30 Thread Eric Biggers
On Thu, Dec 21, 2017 at 05:48:01AM -0800, syzbot wrote: > syzkaller has found reproducer for the following crash on > 8f36e00065436412a02d1f50ad77375bdb506300 > git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw c

Re: KASAN: use-after-free Read in __xfrm_state_lookup

2018-01-30 Thread Eric Biggers
On Wed, Nov 01, 2017 at 10:55:01AM -0700, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 33ad61d0f799656e8987e9c80e6e15151bb857f3 > git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: KASAN: use-after-free Read in sctp_association_free

2018-01-30 Thread Eric Biggers
On Thu, Nov 02, 2017 at 08:07:27PM +0800, Xin Long wrote: > On Thu, Nov 2, 2017 at 1:55 AM, syzbot > > wrote: > > Hello, > > > > syzkaller hit the following crash on > > 25a5d23b47994cdb451dcd2bc8ac310a1492f71b > > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > > compile

Re: KASAN: stack-out-of-bounds Read in rds_sendmsg

2018-01-30 Thread Eric Biggers
On Thu, Dec 21, 2017 at 08:44:32AM -0800, Santosh Shilimkar wrote: > +Avinash > > On 12/21/2017 1:10 AM, syzbot wrote: > > syzkaller has found reproducer for the following crash on > > [..] > > > > > audit: type=1400 audit(1513847224.110:7): avc:  denied  { map } for > > pid=3157 comm="syzkalle

Re: KASAN: use-after-free Read in refcount_inc_not_zero

2018-01-30 Thread Eric Biggers
On Thu, Dec 14, 2017 at 10:23:01AM -0800, syzbot wrote: > syzkaller has found reproducer for the following crash on > 82bcf1def3b5f1251177ad47c44f7e17af039b4b > git://git.cmpxchg.org/linux-mmots.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached.

Re: KASAN: use-after-free Read in map_lookup_elem

2018-01-30 Thread Eric Biggers
On Fri, Jan 12, 2018 at 02:58:02PM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 4147d50978df60f34d444c647dde9e5b34a4315e > git://git.cmpxchg.org/linux-mmots.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > C repro

Re: WARNING in refcount_inc (2)

2018-01-30 Thread Eric Biggers
On Tue, Dec 19, 2017 at 11:26:01AM -0800, syzbot wrote: > syzkaller has found reproducer for the following crash on > 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw

Re: KASAN: slab-out-of-bounds Read in sctp_send_reset_streams

2018-01-31 Thread Eric Biggers
On Sat, Dec 09, 2017 at 02:40:00AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 328b4ed93b69a6f2083d52f31a240a09e5de386a > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: KASAN: double-free or invalid-free in skb_free_head

2018-01-31 Thread Eric Biggers
On Sun, Dec 17, 2017 at 09:52:01PM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > f3b5ad89de16f5d42e8ad36fbdf85f705c1ae051 > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: general protection fault in __netlink_ns_capable

2018-01-31 Thread Eric Biggers
On Thu, Jan 04, 2018 at 10:14:38AM -0800, Andrei Vagin wrote: > On Thu, Jan 04, 2018 at 01:01:17PM +0100, Dmitry Vyukov wrote: > > On Wed, Jan 3, 2018 at 8:37 AM, Andrei Vagin wrote: > > >> > Hello, > > >> > > > >> > syzkaller hit the following crash on > > >> > 75aa5540627fdb3d8f86229776ea87f9952

Re: KASAN: use-after-free Read in tipc_group_size

2018-02-01 Thread Eric Biggers
On Mon, Jan 08, 2018 at 08:11:35PM +, Jon Maloy wrote: > > > > -Original Message- > > From: Cong Wang [mailto:xiyou.wangc...@gmail.com] > > Sent: Monday, January 08, 2018 13:44 > > To: syzbot > > Cc: David Miller ; Jon Maloy > > ; LKML ; Linux > > Kernel Network Developers ; syzkalle

Re: suspicious RCU usage at net/tipc/bearer.c:LINE

2018-02-01 Thread Eric Biggers
On Sun, Dec 31, 2017 at 10:58:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 5aa90a84589282b87666f92b6c3c917c8080a9bf > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: suspicious RCU usage at net/ipv6/ip6_fib.c:LINE

2018-02-01 Thread Eric Biggers
+wei...@google.com On Tue, Jan 02, 2018 at 03:58:02PM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 6bb8824732f69de0f233ae6b1a8158e149627b38 > git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attac

Re: WARNING in reuseport_add_sock

2018-02-01 Thread Eric Biggers
On Fri, Jan 12, 2018 at 03:58:01PM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 30a7acd573899fd8b8ac39236eff6468b195ac7d > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console ou

Re: INFO: trying to register non-static key in pfifo_fast_reset

2018-02-02 Thread Eric Biggers
On Sun, Dec 17, 2017 at 01:56:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 41d8c16909ebda40f7b4982a7f5e2ad102705ade > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console o

Re: INFO: task hung in bpf_exit_net

2018-02-02 Thread Eric Biggers
On Fri, Dec 22, 2017 at 05:04:37PM -0200, Marcelo Ricardo Leitner wrote: > On Fri, Dec 22, 2017 at 04:28:07PM -0200, Marcelo Ricardo Leitner wrote: > > On Fri, Dec 22, 2017 at 11:58:08AM +0100, Dmitry Vyukov wrote: > > ... > > > > Same with this one, perhaps related to / fixed by: > > > > http:

[PATCH] netfilter: nft_ct: define nft_ct_get_eval_counter() only when needed

2016-02-01 Thread Eric Biggers
This eliminates an "unused function" compiler warning when CONFIG_NF_CONNTRACK_LABELS is not defined. Signed-off-by: Eric Biggers --- net/netfilter/nft_ct.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index a0eb216..3cd6b5b 10

[PATCH] net: ibm: emac: remove unused sysrq handler for 'c' key

2017-04-03 Thread Eric Biggers
From: Eric Biggers Since commit d6580a9f1523 ("kexec: sysrq: simplify sysrq-c handler"), the sysrq handler for the 'c' key has been sysrq_crash_op. Debugging code in the ibm_emac driver also tries to register a handler for the 'c' key, but this has no effect becaus

[PATCH] net: socket: don't set sk_uid to garbage value in ->setattr()

2016-12-30 Thread Eric Biggers
From: Eric Biggers ->setattr() was recently implemented for socket files to sync the socket inode's uid to the new 'sk_uid' member of struct sock. It does this by copying over the ia_uid member of struct iattr. However, ia_uid is actually only valid when ATTR_UID is set in ia

Re: [PATCH net-next 1/4] siphash: add cryptographically secure PRF

2017-01-06 Thread Eric Biggers
Hi Jason, just a few comments: On Fri, Jan 06, 2017 at 09:10:52PM +0100, Jason A. Donenfeld wrote: > +#define SIPHASH_ALIGNMENT __alignof__(u64) > +typedef u64 siphash_key_t[2]; I was confused by all the functions passing siphash_key_t "by value" until I saw that it's actually typedefed to u64[2]

Re: [PATCH v2 net-next 0/4] Introduce The SipHash PRF

2017-01-07 Thread Eric Biggers
On Sat, Jan 07, 2017 at 03:40:53PM +0100, Jason A. Donenfeld wrote: > This patch series introduces SipHash into the kernel. SipHash is a > cryptographically secure PRF, which serves a variety of functions, and is > introduced in patch #1. The following patch #2 introduces HalfSipHash, > an optimiza

Re: [PATCH v2 net-next 3/4] secure_seq: use SipHash in place of MD5

2017-01-07 Thread Eric Biggers
Hi David, On Sat, Jan 07, 2017 at 04:37:36PM -0500, David Miller wrote: > From: "Jason A. Donenfeld" > Date: Sat, 7 Jan 2017 15:40:56 +0100 > > > This gives a clear speed and security improvement. Siphash is both > > faster and is more solid crypto than the aging MD5. [snip] > > This and the n

<    1   2