Bug 1395896 - (at least 4.9.0-0.rc4.git2.2.fc26.x86_64): trivial to make kernel oops by deref NULL using AF_ALG
Summary: (at least 4.9.0-0.rc4.git2.2.fc26.x86_64): trivial to make kernel oops by der...
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: rawhide
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2016-11-16 21:24 UTC by Lennart Poettering
Modified: 2016-11-30 15:50 UTC (History)
8 users (show)

Clone Of:
Last Closed: 2016-11-30 15:50:23 UTC

Attachments (Terms of Use)

Description Lennart Poettering 2016-11-16 21:24:38 UTC
Not sure which kernel versions this applies to, but on 4.9.0-0.rc4.git2.2.fc26.x86_64 at least you can trivially easy make the kernel oops by running this little program:


Comment 1 Laura Abbott 2016-11-17 00:09:36 UTC
Looks like 

commit 493b2ed3f7603a15ff738553384d5a4510ffeb95
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Thu Sep 1 17:16:44 2016 +0800

    crypto: algif_hash - Handle NULL hashes correctly
    Right now attempting to read an empty hash simply returns zeroed
    bytes, this patch corrects this by calling the digest function
    using an empty input.
    Reported-by: Russell King - ARM Linux <linux@armlinux.org.uk>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

based on the bisect. I'll start a thread upstream.

Comment 2 Laura Abbott 2016-11-17 21:23:21 UTC
Fix confirmed from maintainer upstream https://patchwork.kernel.org/patch/9434741/

Note You need to log in before you can comment on or make changes to this bug.