All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+2134b6b74dec9f8c760f@syzkaller.appspotmail.com>
To: aviadye@mellanox.com, borisp@mellanox.com, davejwatson@fb.com,
	davem@davemloft.net, linux-kernel@vger.kernel.org,
	netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: KASAN: use-after-free Read in tls_write_space
Date: Sun, 08 Jul 2018 16:55:02 -0700	[thread overview]
Message-ID: <0000000000001c9aa1057085a0bc@google.com> (raw)
In-Reply-To: <0000000000003dab1605704fb71d@google.com>

syzbot has found a reproducer for the following crash on:

HEAD commit:    c47078d6a33f tcp: remove redundant SOCK_DONE checks
git tree:       net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=120012c2400000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a501a01deaf0fe9
dashboard link: https://syzkaller.appspot.com/bug?extid=2134b6b74dec9f8c760f
compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=16950594400000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11d180c8400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+2134b6b74dec9f8c760f@syzkaller.appspotmail.com

TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending  
cookies.  Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending  
cookies.  Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending  
cookies.  Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending  
cookies.  Check SNMP counters.
==================================================================
BUG: KASAN: use-after-free in tls_write_space+0x2c2/0x360  
net/tls/tls_main.c:225
Read of size 1 at addr ffff8801aebdd420 by task ksoftirqd/1/18

CPU: 1 PID: 18 Comm: ksoftirqd/1 Not tainted 4.18.0-rc3+ #113
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
  print_address_description+0x6c/0x20b mm/kasan/report.c:256
  kasan_report_error mm/kasan/report.c:354 [inline]
  kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
  __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
  tls_write_space+0x2c2/0x360 net/tls/tls_main.c:225
  tcp_new_space net/ipv4/tcp_input.c:5081 [inline]
  tcp_check_space+0x551/0x930 net/ipv4/tcp_input.c:5092
  tcp_data_snd_check net/ipv4/tcp_input.c:5102 [inline]
  tcp_rcv_established+0x8db/0x2180 net/ipv4/tcp_input.c:5581
  tcp_v6_do_rcv+0x4b2/0x1450 net/ipv6/tcp_ipv6.c:1325
  tcp_v6_rcv+0x342a/0x3a70 net/ipv6/tcp_ipv6.c:1554
  ip6_input_finish+0x407/0x1a40 net/ipv6/ip6_input.c:383
  NF_HOOK include/linux/netfilter.h:287 [inline]
  ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:426
  dst_input include/net/dst.h:450 [inline]
  ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76
  NF_HOOK include/linux/netfilter.h:287 [inline]
  ipv6_rcv+0x11e/0x650 net/ipv6/ip6_input.c:271
  __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4767
  __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:4872
  process_backlog+0x219/0x760 net/core/dev.c:5663
  napi_poll net/core/dev.c:6078 [inline]
  net_rx_action+0x7a5/0x1950 net/core/dev.c:6144
  __do_softirq+0x2e8/0xb17 kernel/softirq.c:288
  run_ksoftirqd+0x86/0x100 kernel/softirq.c:649
  smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164
  kthread+0x345/0x410 kernel/kthread.c:240
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412

Allocated by task 8159:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:448
  set_track mm/kasan/kasan.c:460 [inline]
  kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
  kmem_cache_alloc_trace+0x152/0x780 mm/slab.c:3620
  kmalloc include/linux/slab.h:513 [inline]
  kzalloc include/linux/slab.h:707 [inline]
  create_ctx net/tls/tls_main.c:535 [inline]
  tls_init+0x1e7/0xb20 net/tls/tls_main.c:659
  tcp_set_ulp+0x1bc/0x520 net/ipv4/tcp_ulp.c:153
  do_tcp_setsockopt.isra.41+0x44a/0x2680 net/ipv4/tcp.c:2748
  tcp_setsockopt+0xc1/0xe0 net/ipv4/tcp.c:3059
  sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3083
  __sys_setsockopt+0x1c5/0x3b0 net/socket.c:1911
  __do_sys_setsockopt net/socket.c:1922 [inline]
  __se_sys_setsockopt net/socket.c:1919 [inline]
  __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1919
  do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 8159:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:448
  set_track mm/kasan/kasan.c:460 [inline]
  __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
  kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
  __cache_free mm/slab.c:3498 [inline]
  kfree+0xd9/0x260 mm/slab.c:3813
  tls_sk_proto_close+0x712/0xae0 net/tls/tls_main.c:297
  inet_release+0x104/0x1f0 net/ipv4/af_inet.c:427
  inet6_release+0x50/0x70 net/ipv6/af_inet6.c:459
  __sock_release+0xd7/0x260 net/socket.c:599
  sock_close+0x19/0x20 net/socket.c:1150
  __fput+0x355/0x8b0 fs/file_table.c:209
  ____fput+0x15/0x20 fs/file_table.c:243
  task_work_run+0x1ec/0x2a0 kernel/task_work.c:113
  tracehook_notify_resume include/linux/tracehook.h:192 [inline]
  exit_to_usermode_loop+0x313/0x370 arch/x86/entry/common.c:166
  prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
  do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8801aebdd340
  which belongs to the cache kmalloc-512 of size 512
The buggy address is located 224 bytes inside of
  512-byte region [ffff8801aebdd340, ffff8801aebdd540)
The buggy address belongs to the page:
page:ffffea0006baf740 count:1 mapcount:0 mapping:ffff8801da800940  
index:0xffff8801aebdd5c0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea00073b1fc8 ffffea0006cd3448 ffff8801da800940
raw: ffff8801aebdd5c0 ffff8801aebdd0c0 0000000100000002 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8801aebdd300: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
  ffff8801aebdd380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801aebdd400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                ^
  ffff8801aebdd480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8801aebdd500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================


  reply	other threads:[~2018-07-08 23:55 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-07-06  7:36 KASAN: use-after-free Read in tls_write_space syzbot
2018-07-08 23:55 ` syzbot [this message]
2019-08-19 21:22 ` Jakub Kicinski

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0000000000001c9aa1057085a0bc@google.com \
    --to=syzbot+2134b6b74dec9f8c760f@syzkaller.appspotmail.com \
    --cc=aviadye@mellanox.com \
    --cc=borisp@mellanox.com \
    --cc=davejwatson@fb.com \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.