From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-1311037-1516782967-2-1549130161994898277 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, FREEMAIL_FORGED_FROMDOMAIN 0.25, FREEMAIL_FROM 0.001, HEADER_FROM_DIFFERENT_DOMAINS 0.25, RCVD_IN_DNSWL_HI -5, T_RP_MATCHES_RCVD -0.01, LANGUAGES en, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='com', MailFrom='org' X-Spam-charsets: X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1516782966; b=uR+HHrDTkaImeFWzHFPBFlMvZPQDdl+wQZxsliScmo8jLW7 rkar2IWYMPNu09VVJmTY8SKb1YQ5qJDamFRFmEWY1lyBigqm/XhbSqq3mz0Op1Rf isKJX21sOz9F4bFhgUUv+Fx2/71t5jmkdrM18OEzwzg+0JwBCKikin88MSAS2n4O cbJ/DC+PaUoE7B8IfgY6BSZmki9ezkrwjFQc3PwhxhpyvkE2qXrC75XA0JiiMBNF uV/GsEmrgsuE2WFW5i0UhhRkD/uJBBNfYemzWSYScUhcpxvEU9/dc/ojMqivWdVq g2wmrba8FdEG4yT0+G6/k5uJ6LepTwgBWJctOSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=from:to:cc:subject:date:message-id :in-reply-to:references:sender:list-id; s=arctest; t=1516782966; bh=i1RPq2r5lI83RqAXlppTnxg8gNc3DTim7TeH1eQf3Ts=; b=bvI4VJFs1JSp hhcvr++LpxUiWUxfgL12ZA62c4cfQWmTT6mK/+/Lh4F5cq8BR7gopWFp8JEqFqJc z+FVk0I58RqRNDHl3hCRVFiH9wv6LWiGUc1apgqj4us/7Gd2XrZ8Qr6z7c8Mg0My 7NuJcXFz17I45Tptr7kTLUPXwK4++gMG7YBR/wHRuy/jJjHH0DlJUytLS8/qKm6s c9vQlVay/OQfm1BHBrzvkn+5nuIENO0QzsbHFCBx9ErY6edY8P7lc5oJpo66zco4 zI0pxXwBc+nkvPY/DbvonYZJhaMpcSDBjT9GpmcpEjK5GZ0atNXRiSe6GOkoz6x0 39gJH3gx1w== ARC-Authentication-Results: i=1; mx5.messagingengine.com; arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=YfFHelDH x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=pass (p=none,has-list-id=yes,d=none) header.from=gmail.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=tE4woZo0; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=gmail.com header.result=pass header_is_org_domain=yes Authentication-Results: mx5.messagingengine.com; arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=YfFHelDH x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=pass (p=none,has-list-id=yes,d=none) header.from=gmail.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=tE4woZo0; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=gmail.com header.result=pass header_is_org_domain=yes Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932464AbeAXIgE (ORCPT ); Wed, 24 Jan 2018 03:36:04 -0500 Received: from mail-pf0-f193.google.com ([209.85.192.193]:42814 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932103AbeAXIgC (ORCPT ); Wed, 24 Jan 2018 03:36:02 -0500 X-Google-Smtp-Source: AH8x225pbVGRIuclcD/NKp42XwJsPVdpUtYT164mnb2QGnzlCZqqu4tf5AK3yjAUa6hQWbiHnjPy3g== From: Eric Biggers To: linux-crypto@vger.kernel.org, Herbert Xu Cc: "David S . Miller" , Megha Dey , Fenghua Yu , Tim Chen , linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Eric Biggers , stable@vger.kernel.org Subject: [PATCH] crypto: sha512-mb - initialize pending lengths correctly Date: Wed, 24 Jan 2018 00:31:27 -0800 Message-Id: <20180124083127.11239-1-ebiggers3@gmail.com> X-Mailer: git-send-email 2.16.0 In-Reply-To: <001a113fae28e4fe39055f757ab5@google.com> References: <001a113fae28e4fe39055f757ab5@google.com> Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: From: Eric Biggers The SHA-512 multibuffer code keeps track of the number of blocks pending in each lane. The minimum of these values is used to identify the next lane that will be completed. Unused lanes are set to a large number (0xFFFFFFFF) so that they don't affect this calculation. However, it was forgotten to set the lengths to this value in the initial state, where all lanes are unused. As a result it was possible for sha512_mb_mgr_get_comp_job_avx2() to select an unused lane, causing a NULL pointer dereference. Specifically this could happen in the case where ->update() was passed fewer than SHA512_BLOCK_SIZE bytes of data, so it then called sha_complete_job() without having actually submitted any blocks to the multi-buffer code. This hit a NULL pointer dereference if another task happened to have submitted blocks concurrently to the same CPU and the flush timer had not yet expired. Fix this by initializing sha512_mb_mgr->lens correctly. As usual, this bug was found by syzkaller. Fixes: 45691e2d9b18 ("crypto: sha512-mb - submit/flush routines for AVX2") Reported-by: syzbot Cc: # v4.8+ Signed-off-by: Eric Biggers --- arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c b/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c index 36870b26067a..d08805032f01 100644 --- a/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c +++ b/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c @@ -57,10 +57,12 @@ void sha512_mb_mgr_init_avx2(struct sha512_mb_mgr *state) { unsigned int j; - state->lens[0] = 0; - state->lens[1] = 1; - state->lens[2] = 2; - state->lens[3] = 3; + /* initially all lanes are unused */ + state->lens[0] = 0xFFFFFFFF00000000; + state->lens[1] = 0xFFFFFFFF00000001; + state->lens[2] = 0xFFFFFFFF00000002; + state->lens[3] = 0xFFFFFFFF00000003; + state->unused_lanes = 0xFF03020100; for (j = 0; j < 4; j++) state->ldata[j].job_in_lane = NULL; -- 2.16.0