KMSAN: uninit-value in af_alg_free_areq_sgls

From 8f083e7b0684a9f91c186d7b46eec34e439689c3 Mon Sep 17 00:00:00 2001

Hi,

May I ask to check whether this patch fixes the issue? I cannot re-create the issue with the reproducter. Yet, as far as I understand, you try to induce errors which shall validate whether the error code paths are correct.

The fix below should ensure this now.

Thanks a lot.

---8<---

From 8f083e7b0684a9f91c186d7b46eec34e439689c3 Mon Sep 17 00:00:00 2001
From: Stephan Mueller <[email protected]>
Date: Sun, 8 Apr 2018 19:53:59 +0200
Subject: [PATCH] AF_ALG: Initialize sg_num_bytes in error code path

The RX SGL in processing is already registered with the RX SGL tracking list to support proper cleanup. The cleanup code path uses the sg_num_bytes variable which must therefore be always initialized, even in the error code path.

Signed-off-by Stephan Mueller <[email protected]>

Reported-by [email protected]

---
 crypto/af_alg.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

crypto/af_alg.c +3 -2

index c49766b03165..0d555c072669 100644
@@ -1156,8 +1156,10 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags,
 
                /* make one iovec available as scatterlist */
                err = af_alg_make_sg(&rsgl->sgl, &msg->msg_iter, seglen);
-               if (err < 0)
+               if (err < 0) {
+                       rsgl->sg_num_bytes = 0;
                        return err;
+               }
 
                /* chain the new scatterlist with previous one */
                if (areq->last_rsgl)
--

2.14.3

--
You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/3337259.MW9pfDCdka%40positron.chronox.de.
For more options, visit https://groups.google.com/d/optout.

You can ask syzbot to test by replying to its report email with a test command, see:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#communication
-with-syzbot

Note that all testing of KMSAN bugs needs to go to KMSAN tree, for details see:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs

Am Montag, 9. April 2018, 09:51:13 CEST schrieb Dmitry Vyukov:

Hi Dmitry,

Quoted 5 lines

You can ask syzbot to test by replying to its report email with a test command, see:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#communication
-with-syzbot

Quoted 3 lines

Note that all testing of KMSAN bugs needs to go to KMSAN tree, for details see:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bugs

Thank you. I will resend the patch later today with the proper tags.

Ciao
Stephan

Quoted 15 lines

Am Montag, 9. April 2018, 09:51:13 CEST schrieb Dmitry Vyukov:

Hi Dmitry,

Quoted 10 lines

You can ask syzbot to test by replying to its report email with a test command, see:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#communica
tion -with-syzbot

Note that all testing of KMSAN bugs needs to go to KMSAN tree, for details
see:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bug
s

Quoted 4 lines

Thank you. I will resend the patch later today with the proper tags.

Ciao
Stephan

Hi Stephan, it seems you never sent your patch out.

Am Donnerstag, 5. Juli 2018, 01:37:57 CEST schrieb Eric Biggers:

Hi Eric,

Quoted 21 lines · Stephan Mueller

Quoted 19 lines

Am Montag, 9. April 2018, 09:51:13 CEST schrieb Dmitry Vyukov:

Hi Dmitry,

Quoted 10 lines

You can ask syzbot to test by replying to its report email with a test command, see:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#communica
tion -with-syzbot

Note that all testing of KMSAN bugs needs to go to KMSAN tree, for details
see:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#kmsan-bug
s

Thank you. I will resend the patch later today with the proper tags.

Ciao
Stephan

Quoted 1 line

Hi Stephan, it seems you never sent your patch out.

Thank you for pointing this one out. At the time, I was searching for how I can refer to the syzbot KMSAN branch that was used to produce the bug report. I only see guidance on how to point to the Linux kernel tree.

Do you have a hint how to point to a different syzbot tree?

Hello,

syzbot tried to test the proposed patch but build/boot failed:

failed to checkout kernel repo https://github.com/google/kmsan.git/---:
failed to run /usr/bin/git [git fetch https://github.com/google/kmsan.git
---]: exit status 129
error: unknown option `-'
usage: git fetch [<options>] [<repository> [<refspec>...]]
or: git fetch [<options>] <group>
or: git fetch --multiple [<options>] [(<repository> | <group>)...]
or: git fetch --all [<options>]

-v, --verbose be more verbose
-q, --quiet be more quiet
--all fetch from all remotes
-a, --append append to .git/FETCH_HEAD instead of overwriting
--upload-pack <path> path to upload pack on remote end
-f, --force force overwrite of local branch
-m, --multiple fetch from multiple remotes
-t, --tags fetch all tags and associated objects
-n do not fetch all tags (--no-tags)
-p, --prune prune remote-tracking branches no longer on
remote --recurse-submodules[=<on-demand>]
control recursive fetching of submodules
--dry-run dry run
-k, --keep keep downloaded pack
-u, --update-head-ok allow updating of HEAD ref
--progress force progress reporting
--depth <depth> deepen history of shallow clone
--unshallow convert to a complete repository
--update-shallow accept refs that update .git/shallow
--refmap <refmap> specify fetch refmap

Tested on:

commit:         [unknown]
git tree:       https://github.com/google/kmsan.git/---> compiler:       clang version 7.0.0 (trunk 334104)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1207511c400000

Am Donnerstag, 5. Juli 2018, 19:02:01 CEST schrieb syzbot:

Hi Dimitry,

does the syzkaller somehow uses the "---" separator as part of the URL?

Quoted 35 lines

syzbot tried to test the proposed patch but build/boot failed:

failed to checkout kernel repo https://github.com/google/kmsan.git/---:
failed to run /usr/bin/git [git fetch https://github.com/google/kmsan.git
---]: exit status 129
error: unknown option `-'
usage: git fetch [<options>] [<repository> [<refspec>...]]
or: git fetch [<options>] <group>
or: git fetch --multiple [<options>] [(<repository> | <group>)...]
or: git fetch --all [<options>]

-v, --verbose be more verbose
-q, --quiet be more quiet
--all fetch from all remotes
-a, --append append to .git/FETCH_HEAD instead of overwriting
--upload-pack <path> path to upload pack on remote end
-f, --force force overwrite of local branch
-m, --multiple fetch from multiple remotes
-t, --tags fetch all tags and associated objects
-n do not fetch all tags (--no-tags)
-p, --prune prune remote-tracking branches no longer on
remote --recurse-submodules[=<on-demand>]
control recursive fetching of submodules
--dry-run dry run
-k, --keep keep downloaded pack
-u, --update-head-ok allow updating of HEAD ref
--progress force progress reporting
--depth <depth> deepen history of shallow clone
--unshallow convert to a complete repository
--update-shallow accept refs that update .git/shallow
--refmap <refmap> specify fetch refmap

Quoted 5 lines

Tested on:

commit:         [unknown]
git tree:       https://github.com/google/kmsan.git/---> compiler:       clang version 7.0.0 (trunk 334104)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1207511c400000

Ciao
Stephan

--
You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/1626520.Rx0128ICKU%40positron.chronox.de.
For more options, visit https://groups.google.com/d/optout.

Quoted 5 lines

Am Donnerstag, 5. Juli 2018, 19:02:01 CEST schrieb syzbot:

Hi Dimitry,

does the syzkaller somehow uses the "---" separator as part of the URL?

It used it as branch. Please see:

https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patch
es

for formats. In all formats a git tree is not enough. And it is not enough to identify code state in any other context too, it's always git repo + branch or commit hash.

Am Freitag, 6. Juli 2018, 09:38:41 CEST schrieb Dmitry Vyukov:

Hi Dmitry,

Quoted 9 lines · Stephan Müller

Quoted 5 lines

Am Donnerstag, 5. Juli 2018, 19:02:01 CEST schrieb syzbot:

Hi Dimitry,

does the syzkaller somehow uses the "---" separator as part of the URL?

It used it as branch. Please see:

Quoted 6 lines

https://github.com/google/syzkaller/blob/master/docs/syzbot.md#testing-patch
es

for formats. In all formats a git tree is not enough. And it is not enough to identify code state in any other context too, it's always git repo + branch or commit hash.

And which branch should I use for the kmsan.git repo?

Changes v3:
* Fix syz testing line

Changes v2:
* Addition of syz testing line

---8<---

The RX SGL in processing is already registered with the RX SGL tracking list to support proper cleanup. The cleanup code path uses the sg_num_bytes variable which must therefore be always initialized, even in the error code path.

Signed-off-by Stephan Mueller <[email protected]>

Reported-by [email protected]

#syz test: https://github.com/google/kmsan.git master

---
 crypto/af_alg.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

crypto/af_alg.c +3 -2

index 49fa8582138b..bd6795ff406a 100644
@@ -1148,8 +1148,10 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags,
 
                /* make one iovec available as scatterlist */
                err = af_alg_make_sg(&rsgl->sgl, &msg->msg_iter, seglen);
-               if (err < 0)
+               if (err < 0) {
+                       rsgl->sg_num_bytes = 0;
                        return err;
+               }
 
                /* chain the new scatterlist with previous one */
                if (areq->last_rsgl)
--

2.17.1

--
You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/1616306.R4SzcgHSdy%40positron.chronox.de.
For more options, visit https://groups.google.com/d/optout.

Hello,

syzbot tried to test the proposed patch but build/boot failed:

lost connection to test machine

[....] Starting enhanced syslogd: rsyslogd [?25l [?1c 7 [1G[ [32m ok [39;49m 8 [?25h [?0c.
[....] Starting periodic command scheduler: cron [?25l [?1c 7 [1G[ [32m ok [39;49m 8 [?25h [?0c.
[....] Starting OpenBSD Secure Shell server: sshd[ 21.709280] random:
sshd: uninitialized urandom read (32 bytes read)
[?25l [?1c 7 [1G[ [32m ok [39;49m 8 [?25h [?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [ 26.229113] random: sshd: uninitialized urandom read (32
bytes read)

[   26.532843] random: sshd: uninitialized urandom read (32 bytes read)
[   27.787277] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.0.2' (ECDSA) to the list of known hosts.
[   33.299368] random: sshd: uninitialized urandom read (32 bytes read)

flag provided but not defined: -os
Usage of ./syz-fuzzer:
-abort_signal int
initial signal to send to executor in error conditions; upgrades to
SIGKILL if executor does not exit
-arch string
target arch (default "amd64")
-buffer_size uint
internal buffer size (in bytes) for executor output
-collide
collide syscalls to provoke data races (default true)
-cover
collect feedback signals (coverage)
-debug
debug output from executor
-executor string
path to executor binary (default "./syz-executor")
-ipc string
ipc scheme (pipe/shmem)
-leak
detect memory leaks
-manager string
manager rpc address
-name string
unique name for manager (default "test")
-output string
write programs to none/stdout/dmesg/file (default "stdout")
-pprof string
address to serve pprof profiles
-procs int
number of parallel test processes (default 1)
-sandbox string
sandbox for fuzzing (none/setuid/namespace) (default "none")
-test
enable image testing mode
-threaded
use threaded mode in executor (default true)
-timeout duration
execution timeout
-v int
verbosity

Tested on:

commit:         9c9df9f275f0 kmsan: remove kmsan_threads_ready
git tree:       https://github.com/google/kmsan.git/master
kernel config:  https://syzkaller.appspot.com/x/.config?x=b11f4cfb262ee607
compiler:       clang version 7.0.0 (trunk 334104)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16a5af84400000

--
You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/syzkaller-bugs/000000000000363e2e0570502d42%40google.com.

For more options, visit https://groups.google.com/d/optout.

Quoted 5 lines · syzbot

Hello,

syzbot tried to test the proposed patch but build/boot failed:

lost connection to test machine

Looking into this.

Quoted 76 lines

[....] Starting enhanced syslogd: rsyslogd [?25l [?1c 7 [1G[ [32m ok [39;49m 8 [?25h [?0c.
[....] Starting periodic command scheduler: cron [?25l [?1c 7 [1G[ [32m ok [39;49m 8 [?25h [?0c.
[....] Starting OpenBSD Secure Shell server: sshd[ 21.709280] random:
sshd: uninitialized urandom read (32 bytes read)
[?25l [?1c 7 [1G[ [32m ok [39;49m 8 [?25h [?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [ 26.229113] random: sshd: uninitialized urandom read (32
bytes read)

[   26.532843] random: sshd: uninitialized urandom read (32 bytes read)
[   27.787277] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.0.2' (ECDSA) to the list of known hosts.
[   33.299368] random: sshd: uninitialized urandom read (32 bytes read)

flag provided but not defined: -os
Usage of ./syz-fuzzer:
-abort_signal int
initial signal to send to executor in error conditions; upgrades to
SIGKILL if executor does not exit
-arch string
target arch (default "amd64")
-buffer_size uint
internal buffer size (in bytes) for executor output
-collide
collide syscalls to provoke data races (default true)
-cover
collect feedback signals (coverage)
-debug
debug output from executor
-executor string
path to executor binary (default "./syz-executor")
-ipc string
ipc scheme (pipe/shmem)
-leak
detect memory leaks
-manager string
manager rpc address
-name string
unique name for manager (default "test")
-output string
write programs to none/stdout/dmesg/file (default "stdout")
-pprof string
address to serve pprof profiles
-procs int
number of parallel test processes (default 1)
-sandbox string
sandbox for fuzzing (none/setuid/namespace) (default "none")
-test
enable image testing mode
-threaded
use threaded mode in executor (default true)
-timeout duration
execution timeout
-v int
verbosity

Tested on:

commit:         9c9df9f275f0 kmsan: remove kmsan_threads_ready
git tree:       https://github.com/google/kmsan.git/master
kernel config:  https://syzkaller.appspot.com/x/.config?x=b11f4cfb262ee607
compiler:       clang version 7.0.0 (trunk 334104)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16a5af84400000

--
You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/syzkaller-bugs/000000000000363e2e0570502d42%40google.com.

Quoted 1 line

For more options, visit https://groups.google.com/d/optout.

On Fri, Jul 6, 2018 at 10:09 AM, syzbot

Quoted 5 lines · <[email protected]> wrote:

Hello,

syzbot tried to test the proposed patch but build/boot failed:

lost connection to test machine

Looking into this.

Changes v3:
* Fix syz testing line

Changes v2:
* Addition of syz testing line

---8<---

The RX SGL in processing is already registered with the RX SGL tracking list to support proper cleanup. The cleanup code path uses the sg_num_bytes variable which must therefore be always initialized, even in the error code path.

Signed-off-by Stephan Mueller <[email protected]>

Reported-by [email protected]

#syz test: https://github.com/google/kmsan.git master

Changes v4:
* Add Fixes and CC line

Changes v3:
* Fix syz testing line

Changes v2:
* Addition of syz testing line

---8<---

The RX SGL in processing is already registered with the RX SGL tracking list to support proper cleanup. The cleanup code path uses the sg_num_bytes variable which must therefore be always initialized, even in the error code path.

Signed-off-by Stephan Mueller <[email protected]>

Reported-by [email protected]

#syz test: https://github.com/google/kmsan.git master

CC <[email protected]> #4.14

Fixes e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")

Fixes d887c52d6ae4 ("crypto: algif_aead - overhaul memory management")