syzbot has bisected this issue to:
commit c662b043cdca89bf0f03fc37251000ac69a3a548
Author: David Howells <[email protected]>
Date: Tue Jun 6 13:08:56 2023 +0000
crypto: af_alg/hash: Support MSG_SPLICE_PAGES
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14a7cbcf280000
start commit: 9a94d764e9bc Merge tag 'mlx5-updates-2023-06-16' of git://..
git tree: net-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=16a7cbcf280000
console output: https://syzkaller.appspot.com/x/log.txt?x=12a7cbcf280000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4a7d74e6a7c3211
dashboard link: https://syzkaller.appspot.com/bug?extid=88f4b1e6cf88da11f5cd
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1152c4ff280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1307cbcf280000
Reported-by: [email protected]
Fixes: c662b043cdca ("crypto: af_alg/hash: Support MSG_SPLICE_PAGES")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git main
crypto: af_alg/hash: Fix recvmsg() after sendmsg(MSG_MORE)
If an AF_ALG socket bound to a hashing algorithm is sent a zero-length
message with MSG_MORE set and then recvmsg() is called without first
sending another message without MSG_MORE set to end the operation, an oops
will occur because the crypto context and result doesn't now get set up in
advance because hash_sendmsg() now defers that as long as possible in the
hope that it can use crypto_ahash_digest() - and then because the message
is zero-length, it the data wrangling loop is skipped.
Fix this by always making a pass of the loop, even in the case that no data
is provided to the sendmsg().
Fix also extract_iter_to_sg() to handle a zero-length iterator by returning
0 immediately.
Whilst we're at it, remove the code to create a kvmalloc'd scatterlist if
we get more than ALG_MAX_PAGES - this shouldn't happen.
Fixes: c662b043cdca ("crypto: af_alg/hash: Support MSG_SPLICE_PAGES")
Reported-by: [email protected]
Link: https://lore.kernel.org/r/[email protected]/
Signed-off-by: David Howells <[email protected]>
cc: Herbert Xu <[email protected]>
cc: "David S. Miller" <[email protected]>
cc: Eric Dumazet <[email protected]>
cc: Jakub Kicinski <[email protected]>
cc: Paolo Abeni <[email protected]>
cc: Jens Axboe <[email protected]>
cc: Matthew Wilcox <[email protected]>
cc: [email protected]
cc: [email protected]
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index dfb048cefb60..1176533a55c9 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -83,26 +83,14 @@ static int hash_sendmsg(struct socket *sock, struct msghdr *msg,
ctx->more = false;
- while (msg_data_left(msg)) {
+ do {
ctx->sgl.sgt.sgl = ctx->sgl.sgl;
ctx->sgl.sgt.nents = 0;
ctx->sgl.sgt.orig_nents = 0;
err = -EIO;
npages = iov_iter_npages(&msg->msg_iter, max_pages);
- if (npages == 0)
- goto unlock_free;
-
- if (npages > ARRAY_SIZE(ctx->sgl.sgl)) {
- err = -ENOMEM;
- ctx->sgl.sgt.sgl =
- kvmalloc(array_size(npages,
- sizeof(*ctx->sgl.sgt.sgl)),
- GFP_KERNEL);
- if (!ctx->sgl.sgt.sgl)
- goto unlock_free;
- }
- sg_init_table(ctx->sgl.sgl, npages);
+ sg_init_table(ctx->sgl.sgl, max_t(size_t, npages, 1));
ctx->sgl.need_unpin = iov_iter_extract_will_pin(&msg->msg_iter);
@@ -111,7 +99,8 @@ static int hash_sendmsg(struct socket *sock, struct msghdr *msg,
if (err < 0)
goto unlock_free;
len = err;
- sg_mark_end(ctx->sgl.sgt.sgl + ctx->sgl.sgt.nents - 1);
+ if (len > 0)
+ sg_mark_end(ctx->sgl.sgt.sgl + ctx->sgl.sgt.nents - 1);
if (!msg_data_left(msg)) {
err = hash_alloc_result(sk, ctx);
@@ -148,7 +137,7 @@ static int hash_sendmsg(struct socket *sock, struct msghdr *msg,
copied += len;
af_alg_free_sg(&ctx->sgl);
- }
+ } while (msg_data_left(msg));
ctx->more = msg->msg_flags & MSG_MORE;
err = 0;
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index e97d7060329e..77a7b18ee751 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -1340,7 +1340,7 @@ ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t maxsize,
struct sg_table *sgtable, unsigned int sg_max,
iov_iter_extraction_t extraction_flags)
{
- if (maxsize == 0)
+ if (!maxsize || !iter->count)
return 0;
switch (iov_iter_type(iter)) {
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: [email protected]
Tested on:
commit: 49310624 Merge branch 'ipv6-random-cleanup-for-extensi..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git main
console output: https://syzkaller.appspot.com/x/log.txt?x=141473e3280000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4a7d74e6a7c3211
dashboard link: https://syzkaller.appspot.com/bug?extid=88f4b1e6cf88da11f5cd
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=13365e5b280000
Note: testing is done by a robot and is best-effort only.
#syz fix: crypto: af_alg/hash: Fix recvmsg() after sendmsg(MSG_MORE)