Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <ZIrWOe4pG7M3TJic@gondor.apana.org.au>
References: <ZIrWOe4pG7M3TJic@gondor.apana.org.au> <000000000000b928f705fdeb873a@google.com> <1433015.1686741914@warthog.procyon.org.uk>
To:     Herbert Xu <herbert@gondor.apana.org.au>
Cc:     dhowells@redhat.com,
        syzbot <syzbot+13a08c0bf4d212766c3c@syzkaller.appspotmail.com>,
        davem@davemloft.net, linux-crypto@vger.kernel.org,
        linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
        pabeni@redhat.com, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [crypto?] general protection fault in shash_async_final
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <415468.1686877408.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Fri, 16 Jun 2023 02:03:28 +0100
Message-ID: <415469.1686877408@warthog.procyon.org.uk>
Precedence: bulk

Hi Herbert,

Here's a slightly more comprehensive test program for the hashing code to
exercise some combinations of sendmsg, sendmsg+MSG_MORE and recvmsg.

David
---
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <unistd.h>
#include <linux/if_alg.h>

#define OSERROR(R, S) do { if ((long)(R) =3D=3D -1L) { perror((S)); exit(1=
); } } while(0)

static int hashfd;
static unsigned char buf[1024], sbuf[1024];
static const unsigned char no_zeros[2]  =3D { 0xe3, 0xb0 };
static const unsigned char one_zero[2]  =3D { 0x6e, 0x34 };
static const unsigned char two_zeros[2] =3D { 0x96, 0xa2 };

static void do_send(unsigned int n, unsigned int flags)
{
	struct msghdr msg;
	struct iovec iov[1];
	int res;

	memset(&msg, 0, sizeof(msg));
	iov[0].iov_base =3D sbuf;
	iov[0].iov_len =3D n;
	msg.msg_iov =3D iov;
	msg.msg_iovlen =3D 1;
	res =3D sendmsg(hashfd, &msg, flags);
	OSERROR(res, "sendmsg");
}

static void do_recv(unsigned int ix, const unsigned char r[2])
{
	struct msghdr msg;
	struct iovec iov[1];
	int res, i;

	memset(&msg, 0, sizeof(msg));
	iov[0].iov_base =3D buf;
	iov[0].iov_len =3D sizeof(buf);
	msg.msg_iov =3D iov;
	msg.msg_iovlen =3D 1;
	res =3D recvmsg(hashfd, &msg, 0);
	OSERROR(res, "recvmsg");

	printf("%3u: ", ix);
	for (i =3D 0; i < res; i++)
		 printf("%02x", buf[i]);
	printf("\n");

	if (buf[0] !=3D r[0] || buf[1] !=3D r[1])
		 fprintf(stderr, "     ^ Bad result!\n");
}

int main(void)
{
	struct sockaddr_alg salg;
	int algfd, res;

	algfd =3D socket(AF_ALG, SOCK_SEQPACKET, 0);
	OSERROR(algfd, "socket");

	memset(&salg, 0, sizeof(salg));
	salg.salg_family =3D AF_ALG;
	strcpy(salg.salg_type, "hash");
	strcpy(salg.salg_name, "sha256");
	res =3D bind(algfd, (struct sockaddr *)&salg, sizeof(salg));
	OSERROR(res, "bind/alg");

	hashfd =3D accept4(algfd, NULL, 0, 0);
	OSERROR(hashfd, "accept/alg");

	//res =3D setsockopt(3, SOL_ALG, ALG_SET_KEY, NULL, 0);
	//OSERROR(res, "setsockopt/ALG_SET_KEY");
	=

	/* Test no send */
	do_recv(__LINE__, no_zeros);

	/* Test single send of 0 */
	do_send(0, 0);
	do_recv(__LINE__, no_zeros);

	do_send(0, MSG_MORE);
	do_recv(__LINE__, no_zeros);

	/* Test single send of 1 */
	do_send(1, 0);
	do_recv(__LINE__, one_zero);

	do_send(1, MSG_MORE);
	do_recv(__LINE__, one_zero);

	/* Test single send of 2 */
	do_send(2, 0);
	do_recv(__LINE__, two_zeros);

	do_send(2, MSG_MORE);
	do_recv(__LINE__, two_zeros);

	/* Test two sends of 1 */
	do_send(1, 0);
	do_send(1, 0);
	do_recv(__LINE__, one_zero);

	do_send(1, 0);
	do_send(1, MSG_MORE);
	do_recv(__LINE__, one_zero);

	do_send(1, MSG_MORE);
	do_send(1, 0);
	do_recv(__LINE__, two_zeros);

	do_send(1, MSG_MORE);
	do_send(1, MSG_MORE);
	do_recv(__LINE__, two_zeros);

	/* Test send of 0 then send of 2 */
	do_send(0, 0);
	do_send(2, 0);
	do_recv(__LINE__, two_zeros);

	do_send(0, 0);
	do_send(2, MSG_MORE);
	do_recv(__LINE__, two_zeros);

	do_send(0, MSG_MORE);
	do_send(2, 0);
	do_recv(__LINE__, two_zeros);

	do_send(0, MSG_MORE);
	do_send(2, MSG_MORE);
	do_recv(__LINE__, two_zeros);

	/* Test send of 2 then send of 0 */
	do_send(2, 0);
	do_send(0, 0);
	do_recv(__LINE__, no_zeros);

	do_send(2, 0);
	do_send(0, MSG_MORE);
	do_recv(__LINE__, no_zeros);

	do_send(2, MSG_MORE);
	do_send(0, 0);
	do_recv(__LINE__, two_zeros);

	do_send(2, MSG_MORE);
	do_send(0, MSG_MORE);
	do_recv(__LINE__, two_zeros);

	return 0;
}