Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 14 Jul 2023 09:10:35 +0700
From:   Bagas Sanjaya <bagasdotme@gmail.com>
To:     Ondrej =?utf-8?B?TW9zbsOhxI1law==?= <omosnacek@gmail.com>,
        Linux Crypto Mailing List <linux-crypto@vger.kernel.org>
Cc:     David Howells <dhowells@redhat.com>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        Paolo Abeni <pabeni@redhat.com>, netdev@vger.kernel.org,
        regressions@lists.linux.dev,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: Another regression in the af_alg series (s390x-specific)
Message-ID: <ZLCumw4oY5QGL8Wi@debian.me>
References: <CAAUqJDuRkHE8fPgZJGaKjUjd3QfGwzfumuJBmStPqBhubxyk_A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="8RhcC9HrFkuMH7pS"
Content-Disposition: inline
In-Reply-To: <CAAUqJDuRkHE8fPgZJGaKjUjd3QfGwzfumuJBmStPqBhubxyk_A@mail.gmail.com>
Precedence: bulk


--8RhcC9HrFkuMH7pS
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Jul 13, 2023 at 10:03:45AM +0200, Ondrej Mosn=C3=A1=C4=8Dek wrote:
> Hi,
>=20
> It turns out that beneath the first bug [1] there was another one
> hiding. It seems to happen only on the s390x architecture when running
> the following libkcapi [2] reproducer:
>=20
> kcapi -x 2 -s -c "gcm(aes)" -i 0d92aa861746b324f20ee6b7 \
>     -k f4a6a5e5f2066f6dd9ec6fc5169c29043560ef595c9e81e76f42d29212cc581c \
>     -a "" -t 5f24c68cbe6f32c29652442bf5d483ad -q ""
>=20
> Frequently (but not always) it triggers an oops like this one:
>=20
> [ 3986.766763] Unable to handle kernel pointer dereference in virtual
> kernel address space
> [ 3986.766774] Failing address: 0000000a00000000 TEID: 0000000a00000803
> [ 3986.766776] Fault in home space mode while using kernel ASCE.
> [ 3986.766778] AS:00000000a43a0007 R3:0000000000000024
> [ 3986.766825] Oops: 003b ilc:2 [#1] SMP
> <snip>
> [ 3986.766877] CPU: 0 PID: 271064 Comm: kcapi Tainted: G        W
>     6.5.0-rc1 #1
> [ 3986.767070] Hardware name: IBM 8561 LT1 400 (z/VM 7.2.0)
> <snip>
> [ 3986.767151] Call Trace:
> [ 3986.767153]  [<000003ff7fc3d47e>] gcm_walk_start+0x16/0x28 [aes_s390]
> [ 3986.767160]  [<00000000a2a342f2>] crypto_aead_decrypt+0x9a/0xb8
> [ 3986.767166]  [<00000000a2a60888>] aead_recvmsg+0x478/0x698
> [ 3986.767169]  [<00000000a2e519a0>] sock_recvmsg+0x70/0xb0
> [ 3986.767175]  [<00000000a2e51a56>] sock_read_iter+0x76/0xa0
> [ 3986.767177]  [<00000000a273e066>] vfs_read+0x26e/0x2a8
> [ 3986.767182]  [<00000000a273e8c4>] ksys_read+0xbc/0x100
> [ 3986.767184]  [<00000000a311d808>] __do_syscall+0x1d0/0x1f8
> [ 3986.767189]  [<00000000a312ff30>] system_call+0x70/0x98
> [ 3986.767193] Last Breaking-Event-Address:
> [ 3986.767193]  [<000003ff7fc3e6b4>] gcm_aes_crypt+0x104/0xa68 [aes_s390]
> [ 3986.767198] Kernel panic - not syncing: Fatal exception: panic_on_oops
>=20
> This time the regression was bisected to:
>=20
> commit c1abe6f570aff4b6d396dc551e60570d2f50bd79
> Author: David Howells <dhowells@redhat.com>
> Date:   Tue Jun 6 14:08:52 2023 +0100
>=20
>    crypto: af_alg: Use extract_iter_to_sg() to create scatterlists
>=20
> I can't see what the problem is with the commit, so I'm reporting here
> hoping that David or someone else can pick it up from here.
>=20

Thanks for the regression report. I'm adding it to regzbot:

#regzbot ^introduced: c1abe6f570aff4b
#regzbot title: kernel pointer dereference regression due to extract_iter_t=
o_sg()

--=20
An old man doll... just what I always wanted! - Clara

--8RhcC9HrFkuMH7pS
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQSSYQ6Cy7oyFNCHrUH2uYlJVVFOowUCZLCulgAKCRD2uYlJVVFO
o4LVAP4kVT6SdcE/KVVP722UHRtHwWu2fafTlhILPIAcai6CxgEA94XCkNYU2sa+
hrNlDgjv0m1noaEIFbImGjD0UkkHJgY=
=3nSU
-----END PGP SIGNATURE-----

--8RhcC9HrFkuMH7pS--