From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Vlad Yasevich <vyasevich@gmail.com>,
Neil Horman <nhorman@tuxdriver.com>,
"David S. Miller" <davem@davemloft.net>,
linux-sctp@vger.kernel.org, netdev <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
syzkaller <syzkaller@googlegroups.com>,
Kostya Serebryany <kcc@google.com>,
Alexander Potapenko <glider@google.com>,
Sasha Levin <sasha.levin@oracle.com>,
Eric Dumazet <edumazet@google.com>
Subject: Re: net/sctp: sctp_datamsg memory leak
Date: Fri, 15 Jan 2016 18:47:35 +0000 [thread overview]
Message-ID: <20160115184735.GF6074@mrl.redhat.com> (raw)
In-Reply-To: <20160108152507.GB6074@mrl.redhat.com>
On Fri, Jan 08, 2016 at 01:25:07PM -0200, Marcelo Ricardo Leitner wrote:
> On Wed, Dec 30, 2015 at 10:24:19PM +0100, Dmitry Vyukov wrote:
> > Hello,
> >
> > The following program leads to leak of multiple objects allocated in
> > sctp_datamsg_from_user:
> >
> >
> > // autogenerated by syzkaller (http://github.com/google/syzkaller)
> > #include <unistd.h>
> > #include <sys/syscall.h>
> > #include <string.h>
> > #include <stdint.h>
> > #include <pthread.h>
> >
> > long r[50];
> >
> > int main()
> > {
> > memset(r, -1, sizeof(r));
> > r[0] = syscall(SYS_mmap, 0x20000000ul, 0x100000ul, 0x3ul,
> > 0x32ul, 0xfffffffffffffffful, 0x0ul);
> > r[1] = syscall(SYS_socket, 0x2ul, 0x80801ul, 0x84ul, 0, 0, 0);
> > memcpy((void*)0x20002f80,
> > "\x02\x00\x33\xd9\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
> > 128);
> > r[3] = syscall(SYS_bind, r[1], 0x20002f80ul, 0x80ul, 0, 0, 0);
> > memcpy((void*)0x20003f80,
> > "\x02\x00\x33\xd9\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
> > 128);
> > r[5] = syscall(SYS_connect, r[1], 0x20003f80ul, 0x80ul, 0, 0, 0);
> > r[6] = syscall(SYS_pread64, r[1], 0x20000feeul, 0xe5ul, 0x0ul, 0, 0);
> > memcpy((void*)0x20003000,
> > "\xdb\x4c\xcc\xa8\x07\xbd\xaa\x58\x7c\x57\x37\x63\xa1\x4d\xdb\x5b\x85\x4e\x37\x3b\x20\xb3\x12\xef\x9b\x75\xf0\x88\x28\xa5\x43\x8e\x56\x59\x3c\x16\xfd\xa0\x01\x4f\x90\x83\x4c\x1b\x22\x3e\xd4\xea\x36\x6f\xb5\x43\x96\x02\x8e\x82\xa1\xc6\x47\xd7\xeb\x08\x56\x6f\x40\xb6\x00\x3f\x52\x38\x99\x2f\x57\x63\x9b\xe4\x0e\xb2\x59\xb2\x59\xbc\x9d\x46\xd0\x52\xd4\x91\xe8\xee\x7f\xcf\x81\xa0\xd5\x10\xc4\x77\xf6\xa1\xa1\x35\xb3\xeb\xb5\x46\xfe\xbc\x83\x74\x9f\x78\xa4\xf1\x0b\xf2\x3a\x41\xc3\x2d\x78\x32\x3b\x88\xe9\xb7\x9f\x56",
> > 128);
> > r[8] = syscall(SYS_write, r[1], 0x20003000ul, 0x80ul, 0, 0, 0);
> > memcpy((void*)0x2000332a,
> > "\xdf\x9a\x13\x9f\x3d\xc5\xd9\xbb\xba\x6d\x46\xb4\xd9\x55\xc0\x39\x0d\xf7\xd0\x9d\x1b\x2b\x8c\xb7\xb2\x52\x8b\xe9\xb8\x73\x6d\x47\x24\x4e\xa3\x1d\xb9\x31\xf1\xae\xa3\x4f\x0f\xd7\xbb\xad\xa7\x4f\xa9\xa3\x2b\x04\xf7\xa8\x5e\x81\x93\x75\x03\x9d\xec\x9a\x03\xbf\xc5\x6c\xb2\xf3\x8b",
> > 69);
> > r[10] = syscall(SYS_write, r[1], 0x2000332aul, 0x45ul, 0, 0, 0);
> > r[11] = syscall(SYS_shutdown, r[1], 0x1ul, 0, 0, 0, 0);
> > memcpy((void*)0x20001919, "\x2e\x2f\x66\x69\x6c\x65\x30\x00", 8);
> > memcpy((void*)0x20001000, "\x2e\x2f\x66\x69\x6c\x65\x30\x00", 8);
> > r[14] = syscall(SYS_rename, 0x20001919ul, 0x20001000ul, 0, 0, 0, 0);
> > *(uint32_t*)0x200013b2 = r[1];
> > *(uint16_t*)0x200013b6 = (uint16_t)0x9;
> > *(uint16_t*)0x200013b8 = (uint16_t)0x8;
> > *(uint32_t*)0x200013ba = r[1];
> > *(uint16_t*)0x200013be = (uint16_t)0xe77;
> > *(uint16_t*)0x200013c0 = (uint16_t)0xa036af6cbe637e9d;
> > *(uint32_t*)0x200013c2 = r[1];
> > *(uint16_t*)0x200013c6 = (uint16_t)0x8;
> > *(uint16_t*)0x200013c8 = (uint16_t)0xfffffffffffff1de;
> > *(uint64_t*)0x20000ff9 = (uint64_t)0x0;
> > *(uint64_t*)0x20001001 = (uint64_t)0x989680;
> > *(uint64_t*)0x20001000 = (uint64_t)0x2;
> > r[27] = syscall(SYS_ppoll, 0x200013b2ul, 0x3ul, 0x20000ff9ul,
> > 0x20001000ul, 0x8ul, 0);
> > *(uint64_t*)0x20001000 = (uint64_t)0x20001d27;
> > *(uint64_t*)0x20001008 = (uint64_t)0x39;
> > *(uint64_t*)0x20001010 = (uint64_t)0x20001ffe;
> > *(uint64_t*)0x20001018 = (uint64_t)0xd9;
> > *(uint64_t*)0x20001020 = (uint64_t)0x20001323;
> > *(uint64_t*)0x20001028 = (uint64_t)0xfb;
> > *(uint64_t*)0x20001030 = (uint64_t)0x20000fe3;
> > *(uint64_t*)0x20001038 = (uint64_t)0x1c;
> > *(uint64_t*)0x20001040 = (uint64_t)0x20001fc6;
> > *(uint64_t*)0x20001048 = (uint64_t)0xea;
> > memcpy((void*)0x20001d27,
> > "\x5d\x27\xd4\x12\xc2\x99\xce\x3f\x64\x88\x1f\x2f\xb1\xe9\xcb\x5c\x1e\x23\x13\xa1\xbb\x1c\xf0\xb3\x76\xa5\xfd\xf6\x0e\x87\xaf\x9f\x68\x47\xb2\x7a\x2e\xb2\xea\x18\xd6\x2a\x9b\xf5\xce\xaa\x33\x6c\x0a\x2d\xdb\x2b\xf7\x6c\xb5\x38\x31",
> > 57);
> > memcpy((void*)0x20001ffe,
> > "\x01\xea\x49\xef\x6c\x2c\x8c\x64\xcd\x39\xcf\xc2\x8c\xba\xd0\x02\x04\x31\x51\x56\x62\x19\xdf\x09\x07\x87\x4f\xf6\x5d\x57\xcc\xea\x52\x02\xc3\x2b\xae\x62\x8e\xf1\x31\xa2\x5e\xf8\x69\x83\xe2\x47\x03\x5a\x2e\x35\x75\x07\xd0\xe6\x8e\x1b\x31\x4b\xef\xf4\x8a\xb4\x7b\xf1\x3a\x9c\x96\xa6\x90\xa0\x3a\x52\x83\x40\xff\x91\x50\x9f\xeb\x98\x9f\xcc\x24\xf6\x46\x1e\xe9\xa5\x34\x35\x9e\x1d\x03\xf4\x9e\x05\x6c\x26\xa0\x09\x07\x55\x26\xdd\x7e\x42\x3c\x59\x80\xdc\x86\x3d\xf7\xed\x87\x92\x27\xf0\x83\x03\x44\xaa\xce\x73\x5e\x51\x69\xd3\xce\xbb\xb7\x6d\x67\x04\xaa\x5c\x34\x0c\xa7\x0e\xd3\xc8\x9c\xd2\x9a\x61\xf2\xeb\x4a\xbf\x89\x30\xfb\xef\x76\x9a\xe6\x6a\xac\x32\x5e\xa3\xc3\x5d\x09\xe2\xc5\x2a\xe4\x83\x81\x76\xa5\x3d\x7f\xa2\xf3\xa4\x7a\x28\x00\x9a\xfe\xcc\x8f\x5b\x24\x74\x73\x72\x2a\x5d\xbb\xd2\xe7\xc3\xb9\xab\xfd\x20\x74\xc9\xc0\x67\xeb\x1b\x06\x8d\x01\x7b\x85\x5f\x11\xbe\x76",
> > 217);
> > memcpy((void*)0x20001323,
> > "\xd7\x13\xc9\x4c\x56\x6e\x36\x52\x01\xcc\x2d\xf6\xbf\xdf\x25\xfb\x80\xb3\x4c\xbb\xcd\x6c\x20\x5b\xdb\x31\x38\x6a\x3f\x1a\xd1\x03\xf8\x2a\x4f\x0f\xe0\x61\xe3\x78\x09\x90\x4f\xea\x4e\x56\x87\x30\x3c\xea\xc2\xb2\x68\xaf\x3b\x40\x73\x78\xa1\x0e\xe9\x26\x50\x2a\x36\x83\xfb\x09\x0d\x23\x70\xc4\x9b\xef\xae\x19\x7a\x3d\x4d\x11\xfb\x8f\xa1\xbc\x0f\xac\xed\x59\x53\xf2\xc2\xce\xdd\x9b\x17\xd9\x1a\xbd\xfe\xe2\x33\x92\xbc\x29\x44\xb1\xa7\xc2\x99\xb9\x5c\xab\xff\x21\x91\xb3\xc3\xc1\xd4\xc6\x35\x4c\xdd\x01\x5a\x4c\x11\x6a\x90\xe6\xe3\x06\xcc\xdc\x99\x26\xfa\xba\x53\xe8\xdb\x4a\x96\x68\x16\xd3\x81\x92\xa7\x33\x97\x96\xbd\x2a\xc0\xc5\x3c\x07\x8a\x43\x1a\x32\x75\x1e\xbb\x9b\xee\xe9\x57\x04\x9d\xd2\xcd\x79\xaf\xf9\x92\x22\x85\xe3\x96\x6b\xb5\xc0\x4d\xe1\x2f\x74\x0c\x4e\xc8\x98\x35\xa8\xa2\xbc\x78\x2f\xbe\x54\x65\xbe\xde\xce\x89\xf0\xdd\xa4\x04\x31\xfb\x0c\x84\x27\x56\xde\x87\xfc\xa1\xb2\xb7\x5a\xc0\x8d\x40\x00\x18\xd2\x8f\x88\x4b\xa7\x30\xe0\x71\xf0\x6a\xff\x52\x1c\x0a\x62\x9b\xe5\x15\x03\x!
> d6!
> > \xe9\x32\
> > xde\x36",
> > 251);
>
> Please clarify this line. It doesn't compile as-is and the len doesn't
> match the data itself.
What should I use here?
Marcelo
WARNING: multiple messages have this Message-ID (diff)
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Vlad Yasevich <vyasevich@gmail.com>,
Neil Horman <nhorman@tuxdriver.com>,
"David S. Miller" <davem@davemloft.net>,
linux-sctp@vger.kernel.org, netdev <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
syzkaller <syzkaller@googlegroups.com>,
Kostya Serebryany <kcc@google.com>,
Alexander Potapenko <glider@google.com>,
Sasha Levin <sasha.levin@oracle.com>,
Eric Dumazet <edumazet@google.com>
Subject: Re: net/sctp: sctp_datamsg memory leak
Date: Fri, 15 Jan 2016 16:47:35 -0200 [thread overview]
Message-ID: <20160115184735.GF6074@mrl.redhat.com> (raw)
In-Reply-To: <20160108152507.GB6074@mrl.redhat.com>
On Fri, Jan 08, 2016 at 01:25:07PM -0200, Marcelo Ricardo Leitner wrote:
> On Wed, Dec 30, 2015 at 10:24:19PM +0100, Dmitry Vyukov wrote:
> > Hello,
> >
> > The following program leads to leak of multiple objects allocated in
> > sctp_datamsg_from_user:
> >
> >
> > // autogenerated by syzkaller (http://github.com/google/syzkaller)
> > #include <unistd.h>
> > #include <sys/syscall.h>
> > #include <string.h>
> > #include <stdint.h>
> > #include <pthread.h>
> >
> > long r[50];
> >
> > int main()
> > {
> > memset(r, -1, sizeof(r));
> > r[0] = syscall(SYS_mmap, 0x20000000ul, 0x100000ul, 0x3ul,
> > 0x32ul, 0xfffffffffffffffful, 0x0ul);
> > r[1] = syscall(SYS_socket, 0x2ul, 0x80801ul, 0x84ul, 0, 0, 0);
> > memcpy((void*)0x20002f80,
> > "\x02\x00\x33\xd9\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
> > 128);
> > r[3] = syscall(SYS_bind, r[1], 0x20002f80ul, 0x80ul, 0, 0, 0);
> > memcpy((void*)0x20003f80,
> > "\x02\x00\x33\xd9\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
> > 128);
> > r[5] = syscall(SYS_connect, r[1], 0x20003f80ul, 0x80ul, 0, 0, 0);
> > r[6] = syscall(SYS_pread64, r[1], 0x20000feeul, 0xe5ul, 0x0ul, 0, 0);
> > memcpy((void*)0x20003000,
> > "\xdb\x4c\xcc\xa8\x07\xbd\xaa\x58\x7c\x57\x37\x63\xa1\x4d\xdb\x5b\x85\x4e\x37\x3b\x20\xb3\x12\xef\x9b\x75\xf0\x88\x28\xa5\x43\x8e\x56\x59\x3c\x16\xfd\xa0\x01\x4f\x90\x83\x4c\x1b\x22\x3e\xd4\xea\x36\x6f\xb5\x43\x96\x02\x8e\x82\xa1\xc6\x47\xd7\xeb\x08\x56\x6f\x40\xb6\x00\x3f\x52\x38\x99\x2f\x57\x63\x9b\xe4\x0e\xb2\x59\xb2\x59\xbc\x9d\x46\xd0\x52\xd4\x91\xe8\xee\x7f\xcf\x81\xa0\xd5\x10\xc4\x77\xf6\xa1\xa1\x35\xb3\xeb\xb5\x46\xfe\xbc\x83\x74\x9f\x78\xa4\xf1\x0b\xf2\x3a\x41\xc3\x2d\x78\x32\x3b\x88\xe9\xb7\x9f\x56",
> > 128);
> > r[8] = syscall(SYS_write, r[1], 0x20003000ul, 0x80ul, 0, 0, 0);
> > memcpy((void*)0x2000332a,
> > "\xdf\x9a\x13\x9f\x3d\xc5\xd9\xbb\xba\x6d\x46\xb4\xd9\x55\xc0\x39\x0d\xf7\xd0\x9d\x1b\x2b\x8c\xb7\xb2\x52\x8b\xe9\xb8\x73\x6d\x47\x24\x4e\xa3\x1d\xb9\x31\xf1\xae\xa3\x4f\x0f\xd7\xbb\xad\xa7\x4f\xa9\xa3\x2b\x04\xf7\xa8\x5e\x81\x93\x75\x03\x9d\xec\x9a\x03\xbf\xc5\x6c\xb2\xf3\x8b",
> > 69);
> > r[10] = syscall(SYS_write, r[1], 0x2000332aul, 0x45ul, 0, 0, 0);
> > r[11] = syscall(SYS_shutdown, r[1], 0x1ul, 0, 0, 0, 0);
> > memcpy((void*)0x20001919, "\x2e\x2f\x66\x69\x6c\x65\x30\x00", 8);
> > memcpy((void*)0x20001000, "\x2e\x2f\x66\x69\x6c\x65\x30\x00", 8);
> > r[14] = syscall(SYS_rename, 0x20001919ul, 0x20001000ul, 0, 0, 0, 0);
> > *(uint32_t*)0x200013b2 = r[1];
> > *(uint16_t*)0x200013b6 = (uint16_t)0x9;
> > *(uint16_t*)0x200013b8 = (uint16_t)0x8;
> > *(uint32_t*)0x200013ba = r[1];
> > *(uint16_t*)0x200013be = (uint16_t)0xe77;
> > *(uint16_t*)0x200013c0 = (uint16_t)0xa036af6cbe637e9d;
> > *(uint32_t*)0x200013c2 = r[1];
> > *(uint16_t*)0x200013c6 = (uint16_t)0x8;
> > *(uint16_t*)0x200013c8 = (uint16_t)0xfffffffffffff1de;
> > *(uint64_t*)0x20000ff9 = (uint64_t)0x0;
> > *(uint64_t*)0x20001001 = (uint64_t)0x989680;
> > *(uint64_t*)0x20001000 = (uint64_t)0x2;
> > r[27] = syscall(SYS_ppoll, 0x200013b2ul, 0x3ul, 0x20000ff9ul,
> > 0x20001000ul, 0x8ul, 0);
> > *(uint64_t*)0x20001000 = (uint64_t)0x20001d27;
> > *(uint64_t*)0x20001008 = (uint64_t)0x39;
> > *(uint64_t*)0x20001010 = (uint64_t)0x20001ffe;
> > *(uint64_t*)0x20001018 = (uint64_t)0xd9;
> > *(uint64_t*)0x20001020 = (uint64_t)0x20001323;
> > *(uint64_t*)0x20001028 = (uint64_t)0xfb;
> > *(uint64_t*)0x20001030 = (uint64_t)0x20000fe3;
> > *(uint64_t*)0x20001038 = (uint64_t)0x1c;
> > *(uint64_t*)0x20001040 = (uint64_t)0x20001fc6;
> > *(uint64_t*)0x20001048 = (uint64_t)0xea;
> > memcpy((void*)0x20001d27,
> > "\x5d\x27\xd4\x12\xc2\x99\xce\x3f\x64\x88\x1f\x2f\xb1\xe9\xcb\x5c\x1e\x23\x13\xa1\xbb\x1c\xf0\xb3\x76\xa5\xfd\xf6\x0e\x87\xaf\x9f\x68\x47\xb2\x7a\x2e\xb2\xea\x18\xd6\x2a\x9b\xf5\xce\xaa\x33\x6c\x0a\x2d\xdb\x2b\xf7\x6c\xb5\x38\x31",
> > 57);
> > memcpy((void*)0x20001ffe,
> > "\x01\xea\x49\xef\x6c\x2c\x8c\x64\xcd\x39\xcf\xc2\x8c\xba\xd0\x02\x04\x31\x51\x56\x62\x19\xdf\x09\x07\x87\x4f\xf6\x5d\x57\xcc\xea\x52\x02\xc3\x2b\xae\x62\x8e\xf1\x31\xa2\x5e\xf8\x69\x83\xe2\x47\x03\x5a\x2e\x35\x75\x07\xd0\xe6\x8e\x1b\x31\x4b\xef\xf4\x8a\xb4\x7b\xf1\x3a\x9c\x96\xa6\x90\xa0\x3a\x52\x83\x40\xff\x91\x50\x9f\xeb\x98\x9f\xcc\x24\xf6\x46\x1e\xe9\xa5\x34\x35\x9e\x1d\x03\xf4\x9e\x05\x6c\x26\xa0\x09\x07\x55\x26\xdd\x7e\x42\x3c\x59\x80\xdc\x86\x3d\xf7\xed\x87\x92\x27\xf0\x83\x03\x44\xaa\xce\x73\x5e\x51\x69\xd3\xce\xbb\xb7\x6d\x67\x04\xaa\x5c\x34\x0c\xa7\x0e\xd3\xc8\x9c\xd2\x9a\x61\xf2\xeb\x4a\xbf\x89\x30\xfb\xef\x76\x9a\xe6\x6a\xac\x32\x5e\xa3\xc3\x5d\x09\xe2\xc5\x2a\xe4\x83\x81\x76\xa5\x3d\x7f\xa2\xf3\xa4\x7a\x28\x00\x9a\xfe\xcc\x8f\x5b\x24\x74\x73\x72\x2a\x5d\xbb\xd2\xe7\xc3\xb9\xab\xfd\x20\x74\xc9\xc0\x67\xeb\x1b\x06\x8d\x01\x7b\x85\x5f\x11\xbe\x76",
> > 217);
> > memcpy((void*)0x20001323,
> > "\xd7\x13\xc9\x4c\x56\x6e\x36\x52\x01\xcc\x2d\xf6\xbf\xdf\x25\xfb\x80\xb3\x4c\xbb\xcd\x6c\x20\x5b\xdb\x31\x38\x6a\x3f\x1a\xd1\x03\xf8\x2a\x4f\x0f\xe0\x61\xe3\x78\x09\x90\x4f\xea\x4e\x56\x87\x30\x3c\xea\xc2\xb2\x68\xaf\x3b\x40\x73\x78\xa1\x0e\xe9\x26\x50\x2a\x36\x83\xfb\x09\x0d\x23\x70\xc4\x9b\xef\xae\x19\x7a\x3d\x4d\x11\xfb\x8f\xa1\xbc\x0f\xac\xed\x59\x53\xf2\xc2\xce\xdd\x9b\x17\xd9\x1a\xbd\xfe\xe2\x33\x92\xbc\x29\x44\xb1\xa7\xc2\x99\xb9\x5c\xab\xff\x21\x91\xb3\xc3\xc1\xd4\xc6\x35\x4c\xdd\x01\x5a\x4c\x11\x6a\x90\xe6\xe3\x06\xcc\xdc\x99\x26\xfa\xba\x53\xe8\xdb\x4a\x96\x68\x16\xd3\x81\x92\xa7\x33\x97\x96\xbd\x2a\xc0\xc5\x3c\x07\x8a\x43\x1a\x32\x75\x1e\xbb\x9b\xee\xe9\x57\x04\x9d\xd2\xcd\x79\xaf\xf9\x92\x22\x85\xe3\x96\x6b\xb5\xc0\x4d\xe1\x2f\x74\x0c\x4e\xc8\x98\x35\xa8\xa2\xbc\x78\x2f\xbe\x54\x65\xbe\xde\xce\x89\xf0\xdd\xa4\x04\x31\xfb\x0c\x84\x27\x56\xde\x87\xfc\xa1\xb2\xb7\x5a\xc0\x8d\x40\x00\x18\xd2\x8f\x88\x4b\xa7\x30\xe0\x71\xf0\x6a\xff\x52\x1c\x0a\x62\x9b\xe5\x15\x03\x!
> d6!
> > \xe9\x32\
> > xde\x36",
> > 251);
>
> Please clarify this line. It doesn't compile as-is and the len doesn't
> match the data itself.
What should I use here?
Marcelo
WARNING: multiple messages have this Message-ID (diff)
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Vlad Yasevich <vyasevich@gmail.com>,
Neil Horman <nhorman@tuxdriver.com>,
"David S. Miller" <davem@davemloft.net>,
linux-sctp@vger.kernel.org, netdev <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
syzkaller <syzkaller@googlegroups.com>,
Kostya Serebryany <kcc@google.com>,
Alexander Potapenko <glider@google.com>,
Sasha Levin <sasha.levin@oracle.com>,
Eric Dumazet <edumazet@google.com>
Subject: Re: net/sctp: sctp_datamsg memory leak
Date: Fri, 15 Jan 2016 16:47:35 -0200 [thread overview]
Message-ID: <20160115184735.GF6074@mrl.redhat.com> (raw)
In-Reply-To: <20160108152507.GB6074@mrl.redhat.com>
On Fri, Jan 08, 2016 at 01:25:07PM -0200, Marcelo Ricardo Leitner wrote:
> On Wed, Dec 30, 2015 at 10:24:19PM +0100, Dmitry Vyukov wrote:
> > Hello,
> >
> > The following program leads to leak of multiple objects allocated in
> > sctp_datamsg_from_user:
> >
> >
> > // autogenerated by syzkaller (http://github.com/google/syzkaller)
> > #include <unistd.h>
> > #include <sys/syscall.h>
> > #include <string.h>
> > #include <stdint.h>
> > #include <pthread.h>
> >
> > long r[50];
> >
> > int main()
> > {
> > memset(r, -1, sizeof(r));
> > r[0] = syscall(SYS_mmap, 0x20000000ul, 0x100000ul, 0x3ul,
> > 0x32ul, 0xfffffffffffffffful, 0x0ul);
> > r[1] = syscall(SYS_socket, 0x2ul, 0x80801ul, 0x84ul, 0, 0, 0);
> > memcpy((void*)0x20002f80,
> > "\x02\x00\x33\xd9\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
> > 128);
> > r[3] = syscall(SYS_bind, r[1], 0x20002f80ul, 0x80ul, 0, 0, 0);
> > memcpy((void*)0x20003f80,
> > "\x02\x00\x33\xd9\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
> > 128);
> > r[5] = syscall(SYS_connect, r[1], 0x20003f80ul, 0x80ul, 0, 0, 0);
> > r[6] = syscall(SYS_pread64, r[1], 0x20000feeul, 0xe5ul, 0x0ul, 0, 0);
> > memcpy((void*)0x20003000,
> > "\xdb\x4c\xcc\xa8\x07\xbd\xaa\x58\x7c\x57\x37\x63\xa1\x4d\xdb\x5b\x85\x4e\x37\x3b\x20\xb3\x12\xef\x9b\x75\xf0\x88\x28\xa5\x43\x8e\x56\x59\x3c\x16\xfd\xa0\x01\x4f\x90\x83\x4c\x1b\x22\x3e\xd4\xea\x36\x6f\xb5\x43\x96\x02\x8e\x82\xa1\xc6\x47\xd7\xeb\x08\x56\x6f\x40\xb6\x00\x3f\x52\x38\x99\x2f\x57\x63\x9b\xe4\x0e\xb2\x59\xb2\x59\xbc\x9d\x46\xd0\x52\xd4\x91\xe8\xee\x7f\xcf\x81\xa0\xd5\x10\xc4\x77\xf6\xa1\xa1\x35\xb3\xeb\xb5\x46\xfe\xbc\x83\x74\x9f\x78\xa4\xf1\x0b\xf2\x3a\x41\xc3\x2d\x78\x32\x3b\x88\xe9\xb7\x9f\x56",
> > 128);
> > r[8] = syscall(SYS_write, r[1], 0x20003000ul, 0x80ul, 0, 0, 0);
> > memcpy((void*)0x2000332a,
> > "\xdf\x9a\x13\x9f\x3d\xc5\xd9\xbb\xba\x6d\x46\xb4\xd9\x55\xc0\x39\x0d\xf7\xd0\x9d\x1b\x2b\x8c\xb7\xb2\x52\x8b\xe9\xb8\x73\x6d\x47\x24\x4e\xa3\x1d\xb9\x31\xf1\xae\xa3\x4f\x0f\xd7\xbb\xad\xa7\x4f\xa9\xa3\x2b\x04\xf7\xa8\x5e\x81\x93\x75\x03\x9d\xec\x9a\x03\xbf\xc5\x6c\xb2\xf3\x8b",
> > 69);
> > r[10] = syscall(SYS_write, r[1], 0x2000332aul, 0x45ul, 0, 0, 0);
> > r[11] = syscall(SYS_shutdown, r[1], 0x1ul, 0, 0, 0, 0);
> > memcpy((void*)0x20001919, "\x2e\x2f\x66\x69\x6c\x65\x30\x00", 8);
> > memcpy((void*)0x20001000, "\x2e\x2f\x66\x69\x6c\x65\x30\x00", 8);
> > r[14] = syscall(SYS_rename, 0x20001919ul, 0x20001000ul, 0, 0, 0, 0);
> > *(uint32_t*)0x200013b2 = r[1];
> > *(uint16_t*)0x200013b6 = (uint16_t)0x9;
> > *(uint16_t*)0x200013b8 = (uint16_t)0x8;
> > *(uint32_t*)0x200013ba = r[1];
> > *(uint16_t*)0x200013be = (uint16_t)0xe77;
> > *(uint16_t*)0x200013c0 = (uint16_t)0xa036af6cbe637e9d;
> > *(uint32_t*)0x200013c2 = r[1];
> > *(uint16_t*)0x200013c6 = (uint16_t)0x8;
> > *(uint16_t*)0x200013c8 = (uint16_t)0xfffffffffffff1de;
> > *(uint64_t*)0x20000ff9 = (uint64_t)0x0;
> > *(uint64_t*)0x20001001 = (uint64_t)0x989680;
> > *(uint64_t*)0x20001000 = (uint64_t)0x2;
> > r[27] = syscall(SYS_ppoll, 0x200013b2ul, 0x3ul, 0x20000ff9ul,
> > 0x20001000ul, 0x8ul, 0);
> > *(uint64_t*)0x20001000 = (uint64_t)0x20001d27;
> > *(uint64_t*)0x20001008 = (uint64_t)0x39;
> > *(uint64_t*)0x20001010 = (uint64_t)0x20001ffe;
> > *(uint64_t*)0x20001018 = (uint64_t)0xd9;
> > *(uint64_t*)0x20001020 = (uint64_t)0x20001323;
> > *(uint64_t*)0x20001028 = (uint64_t)0xfb;
> > *(uint64_t*)0x20001030 = (uint64_t)0x20000fe3;
> > *(uint64_t*)0x20001038 = (uint64_t)0x1c;
> > *(uint64_t*)0x20001040 = (uint64_t)0x20001fc6;
> > *(uint64_t*)0x20001048 = (uint64_t)0xea;
> > memcpy((void*)0x20001d27,
> > "\x5d\x27\xd4\x12\xc2\x99\xce\x3f\x64\x88\x1f\x2f\xb1\xe9\xcb\x5c\x1e\x23\x13\xa1\xbb\x1c\xf0\xb3\x76\xa5\xfd\xf6\x0e\x87\xaf\x9f\x68\x47\xb2\x7a\x2e\xb2\xea\x18\xd6\x2a\x9b\xf5\xce\xaa\x33\x6c\x0a\x2d\xdb\x2b\xf7\x6c\xb5\x38\x31",
> > 57);
> > memcpy((void*)0x20001ffe,
> > "\x01\xea\x49\xef\x6c\x2c\x8c\x64\xcd\x39\xcf\xc2\x8c\xba\xd0\x02\x04\x31\x51\x56\x62\x19\xdf\x09\x07\x87\x4f\xf6\x5d\x57\xcc\xea\x52\x02\xc3\x2b\xae\x62\x8e\xf1\x31\xa2\x5e\xf8\x69\x83\xe2\x47\x03\x5a\x2e\x35\x75\x07\xd0\xe6\x8e\x1b\x31\x4b\xef\xf4\x8a\xb4\x7b\xf1\x3a\x9c\x96\xa6\x90\xa0\x3a\x52\x83\x40\xff\x91\x50\x9f\xeb\x98\x9f\xcc\x24\xf6\x46\x1e\xe9\xa5\x34\x35\x9e\x1d\x03\xf4\x9e\x05\x6c\x26\xa0\x09\x07\x55\x26\xdd\x7e\x42\x3c\x59\x80\xdc\x86\x3d\xf7\xed\x87\x92\x27\xf0\x83\x03\x44\xaa\xce\x73\x5e\x51\x69\xd3\xce\xbb\xb7\x6d\x67\x04\xaa\x5c\x34\x0c\xa7\x0e\xd3\xc8\x9c\xd2\x9a\x61\xf2\xeb\x4a\xbf\x89\x30\xfb\xef\x76\x9a\xe6\x6a\xac\x32\x5e\xa3\xc3\x5d\x09\xe2\xc5\x2a\xe4\x83\x81\x76\xa5\x3d\x7f\xa2\xf3\xa4\x7a\x28\x00\x9a\xfe\xcc\x8f\x5b\x24\x74\x73\x72\x2a\x5d\xbb\xd2\xe7\xc3\xb
9\xab\xfd\x20\x74\xc9\xc0\x67\xeb\x1b\x06\x8d\x01\x7b\x85\x5f\x11\xbe\x76",
> > 217);
> > memcpy((void*)0x20001323,
> > "\xd7\x13\xc9\x4c\x56\x6e\x36\x52\x01\xcc\x2d\xf6\xbf\xdf\x25\xfb\x80\xb3\x4c\xbb\xcd\x6c\x20\x5b\xdb\x31\x38\x6a\x3f\x1a\xd1\x03\xf8\x2a\x4f\x0f\xe0\x61\xe3\x78\x09\x90\x4f\xea\x4e\x56\x87\x30\x3c\xea\xc2\xb2\x68\xaf\x3b\x40\x73\x78\xa1\x0e\xe9\x26\x50\x2a\x36\x83\xfb\x09\x0d\x23\x70\xc4\x9b\xef\xae\x19\x7a\x3d\x4d\x11\xfb\x8f\xa1\xbc\x0f\xac\xed\x59\x53\xf2\xc2\xce\xdd\x9b\x17\xd9\x1a\xbd\xfe\xe2\x33\x92\xbc\x29\x44\xb1\xa7\xc2\x99\xb9\x5c\xab\xff\x21\x91\xb3\xc3\xc1\xd4\xc6\x35\x4c\xdd\x01\x5a\x4c\x11\x6a\x90\xe6\xe3\x06\xcc\xdc\x99\x26\xfa\xba\x53\xe8\xdb\x4a\x96\x68\x16\xd3\x81\x92\xa7\x33\x97\x96\xbd\x2a\xc0\xc5\x3c\x07\x8a\x43\x1a\x32\x75\x1e\xbb\x9b\xee\xe9\x57\x04\x9d\xd2\xcd\x79\xaf\xf9\x92\x22\x85\xe3\x96\x6b\xb5\xc0\x4d\xe1\x2f\x74\x0c\x4e\xc8\x98\x35\xa8\xa2\xbc\x78\x2f\xb
e\x54\x65\xbe\xde\xce\x89\xf0\xdd\xa4\x04\x31\xfb\x0c\x84\x27\x56\xde\x87\xfc\xa1\xb2\xb7\x5a\xc0\x8d\x40\x00\x18\xd2\x8f\x88\x4b\xa7\x30\xe0\x71\xf0\x6a\xff\x52\x1c\x0a\x62\x9b\xe5\x15\x03\x!
> d6!
> > \xe9\x32\
> > xde\x36",
> > 251);
>
> Please clarify this line. It doesn't compile as-is and the len doesn't
> match the data itself.
What should I use here?
Marcelo
next prev parent reply other threads:[~2016-01-15 18:47 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-30 21:24 net/sctp: sctp_datamsg memory leak Dmitry Vyukov
2015-12-30 21:24 ` Dmitry Vyukov
2015-12-30 21:24 ` Dmitry Vyukov
2016-01-08 15:25 ` Marcelo Ricardo Leitner
2016-01-08 15:25 ` Marcelo Ricardo Leitner
2016-01-08 15:25 ` Marcelo Ricardo Leitner
2016-01-15 18:47 ` Marcelo Ricardo Leitner [this message]
2016-01-15 18:47 ` Marcelo Ricardo Leitner
2016-01-15 18:47 ` Marcelo Ricardo Leitner
2016-01-15 18:55 ` Dmitry Vyukov
2016-01-15 18:55 ` Dmitry Vyukov
2016-01-15 18:55 ` Dmitry Vyukov
2016-01-15 19:07 ` Marcelo Ricardo Leitner
2016-01-15 19:07 ` Marcelo Ricardo Leitner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160115184735.GF6074@mrl.redhat.com \
--to=marcelo.leitner@gmail.com \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=glider@google.com \
--cc=kcc@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sctp@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=sasha.levin@oracle.com \
--cc=syzkaller@googlegroups.com \
--cc=vyasevich@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.