Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <000000000000b928f705fdeb873a@google.com>
References: <000000000000b928f705fdeb873a@google.com>
To:     syzbot <syzbot+13a08c0bf4d212766c3c@syzkaller.appspotmail.com>
Cc:     dhowells@redhat.com, davem@davemloft.net,
        herbert@gondor.apana.org.au, linux-crypto@vger.kernel.org,
        linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
        pabeni@redhat.com, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [crypto?] general protection fault in shash_async_final
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1433014.1686741914.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Wed, 14 Jun 2023 12:25:14 +0100
Message-ID: <1433015.1686741914@warthog.procyon.org.uk>
Precedence: bulk

Here's a reduced testcase for this.  The key seems to be passing MSG_MORE =
to
sendmsg() and then not following up with more data before calling recvmsg(=
).
Apart from not oopsing, I wonder what the behaviour should be here?  Shoul=
d
recvmsg() return an error (EAGAIN or ENODATA maybe) or should it close the
existing operation?

David
---
// https://syzkaller.appspot.com/bug?id=3Df5d9d503fe959e3b605abdaeedb39b07=
2556281a
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <unistd.h>
#include <linux/if_alg.h>

#define OSERROR(R, S) do { if ((long)(R) =3D=3D -1L) { perror((S)); exit(1=
); } } while(0)

int main(void)
{
	struct sockaddr_alg salg;
	struct msghdr msg;
	int algfd, hashfd, res;

	algfd =3D socket(AF_ALG, SOCK_SEQPACKET, 0);
	OSERROR(algfd, "socket");

	memset(&salg, 0, sizeof(salg));
	salg.salg_family =3D AF_ALG;
	strcpy(salg.salg_type, "hash");
	strcpy(salg.salg_name, "digest_null-generic");
	res =3D bind(algfd, (struct sockaddr *)&salg, sizeof(salg));
	OSERROR(res, "bind/alg");

	hashfd =3D accept4(algfd, NULL, 0, 0);
	OSERROR(hashfd, "accept/alg");

	res =3D setsockopt(3, SOL_ALG, ALG_SET_KEY, NULL, 0);
	OSERROR(res, "setsockopt/ALG_SET_KEY");

	memset(&msg, 0, sizeof(msg));
	res =3D sendmsg(hashfd, &msg, MSG_MORE);
	OSERROR(res, "sendmsg");

	res =3D recvmsg(hashfd, &msg, 0);
	OSERROR(res, "recvmsg");
	return 0;
}