From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vlad Yasevich Date: Wed, 25 Nov 2015 15:12:28 +0000 Subject: Re: use-after-free in sctp_do_sm Message-Id: <5655CFDC.4050206@gmail.com> List-Id: References: <20151124204553.GB3364@hmsreliant.think-freely.org> In-Reply-To: <20151124204553.GB3364@hmsreliant.think-freely.org> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Neil Horman , Dmitry Vyukov Cc: linux-sctp@vger.kernel.org, netdev , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin , Eric Dumazet , =?UTF-8?B?TWFjaWVqIMW7ZW5jenlrb3dza2k=?= On 11/24/2015 03:45 PM, Neil Horman wrote: > On Tue, Nov 24, 2015 at 11:10:32AM +0100, Dmitry Vyukov wrote: >> On Tue, Nov 24, 2015 at 10:31 AM, Dmitry Vyukov wrote: >>> On Tue, Nov 24, 2015 at 10:15 AM, Dmitry Vyukov wrote: >>>> Hello, >>>> >>>> The following program triggers use-after-free in sctp_do_sm: >>>> >>>> // autogenerated by syzkaller (http://github.com/google/syzkaller) >>>> #include >>>> #include >>>> #include >>>> >>>> int main() >>>> { >>>> long r0 = syscall(SYS_socket, 0xaul, 0x80805ul, 0x0ul, 0, 0, 0); >>>> long r1 = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, >>>> 0x32ul, 0xfffffffffffffffful, 0x0ul); >>>> memcpy((void*)0x20002fe4, >>>> "\x0a\x00\x33\xe7\xeb\x9d\xcf\x61\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xc5\xc8\x88\x64", >>>> 28); >>>> long r3 = syscall(SYS_bind, r0, 0x20002fe4ul, 0x1cul, 0, 0, 0); >>>> memcpy((void*)0x20000faa, >>>> "\x9b\x01\x7d\xcd\xb8\x6a\xc7\x3d\x09\x3a\x07\x00\xa7\xc4\xe9\xee\x0a\xd6\xec\xde\x26\x75\x5f\x22\xae\x4e\x33\x00\xb0\x76\x10\x70\xd6\xca\x19\xbc\x15\x83\xcf\x2e\xbc\x99\x0c\x5e\x83\x89\xc1\x44\x9c\x6e\x74\xd8\x5d\x5d\xd0\xf0\xdf\x47\xc0\x00\x71\x0b\x55\x4c\xab\xf0\xd8\x90\xd5\x92\x8c\x6e\x33\x22\x15\x5b\x19\xfb\xed\xdd\xa6\xac\xcb\x60\xcf\xe2\xde\xed\xdb\x95\x5c\xaa\x20\xa3", >>>> 94); >>>> memcpy((void*)0x2000033a, >>>> "\x02\x00\x33\xe2\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", >>>> 128); >>>> long r6 = syscall(SYS_sendto, r0, 0x20000faaul, 0x5eul, >>>> 0x81ul, 0x2000033aul, 0x80ul); >>>> return 0; >>>> } >>>> >>>> >>>> ================================= >>>> BUG: KASAN: use-after-free in sctp_do_sm+0x42f6/0x4f60 at addr ffff880036fa80a8 >>>> Read of size 4 by task a.out/5664 >>>> ======================================>>>> BUG kmalloc-4096 (Tainted: G B ): kasan: bad access detected >>>> ----------------------------------------------------------------------------- >>>> >>>> INFO: Allocated in sctp_association_new+0x6f/0x1ea0 age=8 cpu=1 pidV64 >>>> [< none >] kmem_cache_alloc_trace+0x1cf/0x220 ./mm/slab.c:3707 >>>> [< none >] sctp_association_new+0x6f/0x1ea0 >>>> [< none >] sctp_sendmsg+0x1954/0x28e0 >>>> [< none >] inet_sendmsg+0x316/0x4f0 ./net/ipv4/af_inet.c:802 >>>> [< inline >] __sock_sendmsg_nosec ./net/socket.c:641 >>>> [< inline >] __sock_sendmsg ./net/socket.c:651 >>>> [< none >] sock_sendmsg+0xca/0x110 ./net/socket.c:662 >>>> [< none >] SYSC_sendto+0x208/0x350 ./net/socket.c:1841 >>>> [< none >] SyS_sendto+0x40/0x50 ./net/socket.c:1862 >>>> [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a >>>> >>>> INFO: Freed in sctp_association_put+0x150/0x250 age cpu=1 pidV64 >>>> [< none >] kfree+0x199/0x1b0 ./mm/slab.c:1211 >>>> [< none >] sctp_association_put+0x150/0x250 >>>> [< none >] sctp_association_free+0x498/0x630 >>>> [< none >] sctp_do_sm+0xd8b/0x4f60 >>>> [< none >] sctp_primitive_SHUTDOWN+0xa9/0xd0 >>>> [< none >] sctp_close+0x616/0x790 >>>> [< none >] inet_release+0xed/0x1c0 ./net/ipv4/af_inet.c:471 >>>> [< none >] inet6_release+0x50/0x70 ./net/ipv6/af_inet6.c:416 >>>> [< inline >] constant_test_bit ././arch/x86/include/asm/bitops.h:321 >>>> [< none >] sock_release+0x8d/0x200 ./net/socket.c:601 >>>> [< none >] sock_close+0x16/0x20 ./net/socket.c:1188 >>>> [< none >] __fput+0x21d/0x6e0 ./fs/file_table.c:265 >>>> [< none >] ____fput+0x15/0x20 ./fs/file_table.c:84 >>>> [< none >] task_work_run+0x163/0x1f0 ./include/trace/events/rcu.h:20 >>>> [< inline >] __list_add ./include/linux/list.h:42 >>>> [< inline >] list_add_tail ./include/linux/list.h:76 >>>> [< inline >] list_move_tail ./include/linux/list.h:168 >>>> [< inline >] reparent_leader ./kernel/exit.c:618 >>>> [< inline >] forget_original_parent ./kernel/exit.c:669 >>>> [< inline >] exit_notify ./kernel/exit.c:697 >>>> [< none >] do_exit+0x809/0x2b90 ./kernel/exit.c:878 >>>> [< none >] do_group_exit+0x108/0x320 ./kernel/exit.c:985 >>>> >>>> INFO: Slab 0xffffea0000dbea00 objects=7 used=1 fp=0xffff880036fa8000 >>>> flags=0x100000000004080 >>>> INFO: Object 0xffff880036fa8000 @offset=0 fp=0xffff880036fad668 >>>> CPU: 1 PID: 5664 Comm: a.out Tainted: G B 4.4.0-rc1+ #81 >>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >>>> 00000000ffffffff ffff880061d6f700 ffffffff825d3336 ffff88003e806d00 >>>> ffff880036fa8000 ffff880036fa8000 ffff880061d6f730 ffffffff81618784 >>>> ffff88003e806d00 ffffea0000dbea00 ffff880036fa8000 0000000000000000 >>>> >>>> Call Trace: >>>> [] __asan_report_load4_noabort+0x3e/0x40 >>>> [] sctp_do_sm+0x42f6/0x4f60 >>>> [] sctp_primitive_SHUTDOWN+0xa9/0xd0 >>>> [] sctp_close+0x616/0x790 >>>> [] inet_release+0xed/0x1c0 ./net/ipv4/af_inet.c:471 >>>> [] inet6_release+0x50/0x70 ./net/ipv6/af_inet6.c:416 >>>> [< inline >] constant_test_bit ././arch/x86/include/asm/bitops.h:321 >>>> [] sock_release+0x8d/0x200 ./net/socket.c:601 >>>> [] sock_close+0x16/0x20 ./net/socket.c:1188 >>>> [] __fput+0x21d/0x6e0 ./fs/file_table.c:265 >>>> [] ____fput+0x15/0x20 ./fs/file_table.c:84 >>>> [] task_work_run+0x163/0x1f0 ./include/trace/events/rcu.h:20 >>>> [< inline >] __list_add ./include/linux/list.h:42 >>>> [< inline >] list_add_tail ./include/linux/list.h:76 >>>> [< inline >] list_move_tail ./include/linux/list.h:168 >>>> [< inline >] reparent_leader ./kernel/exit.c:618 >>>> [< inline >] forget_original_parent ./kernel/exit.c:669 >>>> [< inline >] exit_notify ./kernel/exit.c:697 >>>> [] do_exit+0x809/0x2b90 ./kernel/exit.c:878 >>>> [] do_group_exit+0x108/0x320 ./kernel/exit.c:985 >>>> [] SyS_exit_group+0x1d/0x20 ./kernel/exit.c:1002 >>>> [] entry_SYSCALL_64_fastpath+0x16/0x7a >>>> ================================= >>>> >>>> >>>> I am on commit 90b55590c43258a157a2a143748455dcc50fbb53 of net-next (Nov 22). >> >> The right commit is: >> >> commit 7d267278a9ece963d77eefec61630223fce08c6c >> Author: Rainer Weikusat >> Date: Fri Nov 20 22:07:23 2015 +0000 >> unix: avoid use-after-free in ep_remove_wait_queue > This commit doesn't seem to exist I don't think this matters... I think what's happening is that a close is happening on a socket still in connection initialization phase and we've never handled that particularly well... Net-next kernel with mem debugging hangs on boot for me with a ton of printks suppressed. Will try the net kernel to see if that's better -vlad > > Neil > >> -- >> To unsubscribe from this list: send the line "unsubscribe linux-sctp" in >> the body of a message to majordomo@vger.kernel.org >> More majordomo info at http://vger.kernel.org/majordomo-info.html >>