From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753500Ab2CMUXq (ORCPT ); Tue, 13 Mar 2012 16:23:46 -0400 Received: from mx1.redhat.com ([209.132.183.28]:56034 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751783Ab2CMUXo (ORCPT ); Tue, 13 Mar 2012 16:23:44 -0400 Date: Tue, 13 Mar 2012 16:23:38 -0400 From: Dave Jones To: "Eric W. Biederman" Cc: netdev@vger.kernel.org, Linux Kernel Subject: Re: tun oops dereferencing garbage nsproxy-> address. Message-ID: <20120313202338.GA23737@redhat.com> Mail-Followup-To: Dave Jones , "Eric W. Biederman" , netdev@vger.kernel.org, Linux Kernel References: <20120313034201.GA13156@redhat.com> <20120313182646.GB11500@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Mar 13, 2012 at 01:10:06PM -0700, Eric W. Biederman wrote: > > > > My guess is the fuzzer called some syscall that set current->nsproxy > > > > to garbage (0x0000000100000001), which later got dereferenced when it > > > > subsequently randomly did an open() on tun. > > > > > > It smells like a memory stomp. current->nsproxy is always supposed to > > > have a valid value, and it never would have an odd value. The value > > > should always be at least 8 byte aligned. > > > > > > Since the value is impossible this doesn't feel like a path where the > > > error handling is wrong. > > > > 0x0000000100000001 looks like one of strange values my fuzzer passes syscalls > > when they ask for an address. > > > > So something managed to get that set as nsproxy. The fuzzer avoids calling > > clone(), so are there other syscalls that might set this ? > > setns and unshare might touch the nsproxy for the same reasons as clone, > but the rules are very similar to clone. Hmm, the only way that seems possible to set nsproxy is if the process was run with CAP_SYS_ADMIN, which it wasn't. Maybe your theory holds water, and something else wrote that value to the current thread at a random offset. Fun. Dave