* sctp refcount bug.
@ 2017-07-13 14:36 Dave Jones
2017-07-13 14:38 ` Marcelo Ricardo Leitner
0 siblings, 1 reply; 3+ messages in thread
From: Dave Jones @ 2017-07-13 14:36 UTC (permalink / raw)
To: netdev; +Cc: Vlad Yasevich, Neil Horman, linux-sctp
Hit this on Linus' current tree.
refcount_t: underflow; use-after-free.
------------[ cut here ]------------
WARNING: CPU: 2 PID: 14455 at lib/refcount.c:186 refcount_sub_and_test+0x45/0x50
CPU: 2 PID: 14455 Comm: trinity-c46 Tainted: G D 4.12.0-think+ #11
task: ffff8804fc71b8c0 task.stack: ffffc90002328000
RIP: 0010:refcount_sub_and_test+0x45/0x50
RSP: 0018:ffffc9000232ba58 EFLAGS: 00010282
RAX: 0000000000000026 RBX: ffff88001db1d1c0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88050a3ccca8 RDI: ffff88050a3ccca8
RBP: ffffc9000232ba58 R08: 0000000000000000 R09: 0000000000000001
R10: ffffc9000232ba88 R11: 0000000000000000 R12: ffff88000d3f9b40
R13: ffff880456948008 R14: ffff880456948870 R15: ffffc9000232bd10
FS: 00007f79b1032700(0000) GS:ffff88050a200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000008436726348 CR3: 000000022cc87000 CR4: 00000000001406e0
DR0: 00007f731068f000 DR1: 00007f2d83eb9000 DR2: 00007f302340e000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
sctp_wfree+0x5d/0x190 [sctp]
skb_release_head_state+0x64/0xc0
skb_release_all+0x12/0x30
consume_skb+0x50/0x170
sctp_chunk_put+0x59/0x80 [sctp]
sctp_chunk_free+0x26/0x30 [sctp]
__sctp_outq_teardown+0x1d8/0x270 [sctp]
sctp_outq_free+0xe/0x10 [sctp]
sctp_association_free+0x92/0x220 [sctp]
sctp_do_sm+0x12a6/0x1920 [sctp]
? __get_user_4+0x18/0x20
? no_context+0x3f/0x360
? lock_acquire+0xe7/0x1e0
? skb_dequeue+0x1d/0x70
sctp_primitive_SHUTDOWN+0x33/0x40 [sctp]
sctp_close+0x26e/0x2a0 [sctp]
inet_release+0x3c/0x60
sock_release+0x1f/0x80
sock_close+0x12/0x20
__fput+0xf8/0x200
____fput+0xe/0x10
task_work_run+0x85/0xc0
exit_to_usermode_loop+0xa8/0xb0
do_syscall_64+0x151/0x190
entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7f79b095b1e9
RSP: 002b:00007ffc5eca3088 EFLAGS: 00000246
ORIG_RAX: 0000000000000120
RAX: fffffffffffffff2 RBX: 0000000000000120 RCX: 00007f79b095b1e9
RDX: 000000000000006e RSI: 0000008436738120 RDI: 0000000000000130
RBP: 00007ffc5eca3130 R08: 0000000000000000 R09: 0000000000000ff0
R10: 0000000000080800 R11: 0000000000000246 R12: 0000000000000002
R13: 00007f79b0ee9058 R14: 00007f79b1032698 R15: 00007f79b0ee9000
Code: 75 e6 85 d2 0f 94 c0 c3 31 c0 c3 80 3d ce 95 bc 00 00 75 f4 55 48 c7 c7 00 d9 ee 81 48 89 e5 c6 05 ba 95 bc 00 01 e8 fc 2c c0 ff <0f> ff 31 c0 5d c3 0f 1f 44 00 00 55 48 89 fe bf 01 00 00 00 48
---[ end trace 19b7bd878c0f56fd ]---
------------[ cut here ]------------
WARNING: CPU: 2 PID: 14455 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x1b8/0x1f0
CPU: 2 PID: 14455 Comm: trinity-c46 Tainted: G D W 4.12.0-think+ #11
task: ffff8804fc71b8c0 task.stack: ffffc90002328000
RIP: 0010:inet_sock_destruct+0x1b8/0x1f0
RSP: 0018:ffffc9000232bcf8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88000d3f9b40 RCX: 0000000000000000
RDX: 00000000fffffd00 RSI: 0000000000000300 RDI: ffff88000d3f9ca8
RBP: ffffc9000232bd08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88000d3f9ca8
R13: ffff88000d3f9b40 R14: ffff88000d3f9bc8 R15: ffff8801836e21d0
FS: 00007f79b1032700(0000) GS:ffff88050a200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000003b9ab732 CR3: 000000022cc87000 CR4: 00000000001406e0
DR0: 00007f731068f000 DR1: 00007f2d83eb9000 DR2: 00007f302340e000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
sctp_destruct_sock+0x25/0x30 [sctp]
__sk_destruct+0x28/0x230
sk_destruct+0x20/0x30
__sk_free+0x43/0xa0
sk_free+0x25/0x30
sctp_close+0x218/0x2a0 [sctp]
inet_release+0x3c/0x60
sock_release+0x1f/0x80
sock_close+0x12/0x20
__fput+0xf8/0x200
____fput+0xe/0x10
task_work_run+0x85/0xc0
exit_to_usermode_loop+0xa8/0xb0
do_syscall_64+0x151/0x190
entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7f79b095b1e9
RSP: 002b:00007ffc5eca3088 EFLAGS: 00000246
ORIG_RAX: 0000000000000120
RAX: fffffffffffffff2 RBX: 0000000000000120 RCX: 00007f79b095b1e9
RDX: 000000000000006e RSI: 0000008436738120 RDI: 0000000000000130
RBP: 00007ffc5eca3130 R08: 0000000000000000 R09: 0000000000000ff0
R10: 0000000000080800 R11: 0000000000000246 R12: 0000000000000002
R13: 00007f79b0ee9058 R14: 00007f79b1032698 R15: 00007f79b0ee9000
Code: df e8 bd 5f f4 ff e9 07 ff ff ff 0f ff 8b 83 8c 02 00 00 85 c0 0f 84 2d ff ff ff 0f ff 8b 93 88 02 00 00 85 d2 0f 84 2b ff ff ff <0f> ff 8b 83 40 02 00 00 85 c0 0f 84 29 ff ff ff 0f ff e9 22 ff
---[ end trace 19b7bd878c0f56fe ]---
------------[ cut here ]------------
WARNING: CPU: 2 PID: 14455 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x1c8/0x1f0
CPU: 2 PID: 14455 Comm: trinity-c46 Tainted: G D W 4.12.0-think+ #11
task: ffff8804fc71b8c0 task.stack: ffffc90002328000
RIP: 0010:inet_sock_destruct+0x1c8/0x1f0
RSP: 0018:ffffc9000232bcf8 EFLAGS: 00010206
RAX: 0000000000000300 RBX: ffff88000d3f9b40 RCX: 0000000000000000
RDX: 00000000fffffd00 RSI: 0000000000000300 RDI: ffff88000d3f9ca8
RBP: ffffc9000232bd08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88000d3f9ca8
R13: ffff88000d3f9b40 R14: ffff88000d3f9bc8 R15: ffff8801836e21d0
FS: 00007f79b1032700(0000) GS:ffff88050a200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdebc2fa000 CR3: 000000022cc87000 CR4: 00000000001406e0
DR0: 00007f731068f000 DR1: 00007f2d83eb9000 DR2: 00007f302340e000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
sctp_destruct_sock+0x25/0x30 [sctp]
__sk_destruct+0x28/0x230
sk_destruct+0x20/0x30
__sk_free+0x43/0xa0
sk_free+0x25/0x30
sctp_close+0x218/0x2a0 [sctp]
inet_release+0x3c/0x60
sock_release+0x1f/0x80
sock_close+0x12/0x20
__fput+0xf8/0x200
____fput+0xe/0x10
task_work_run+0x85/0xc0
exit_to_usermode_loop+0xa8/0xb0
do_syscall_64+0x151/0x190
entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x7f79b095b1e9
RSP: 002b:00007ffc5eca3088 EFLAGS: 00000246
ORIG_RAX: 0000000000000120
RAX: fffffffffffffff2 RBX: 0000000000000120 RCX: 00007f79b095b1e9
RDX: 000000000000006e RSI: 0000008436738120 RDI: 0000000000000130
RBP: 00007ffc5eca3130 R08: 0000000000000000 R09: 0000000000000ff0
R10: 0000000000080800 R11: 0000000000000246 R12: 0000000000000002
R13: 00007f79b0ee9058 R14: 00007f79b1032698 R15: 00007f79b0ee9000
Code: 02 00 00 85 c0 0f 84 2d ff ff ff 0f ff 8b 93 88 02 00 00 85 d2 0f 84 2b ff ff ff 0f ff 8b 83 40 02 00 00 85 c0 0f 84 29 ff ff ff <0f> ff e9 22 ff ff ff 48 89 de 48 c7 c7 c8 7c f7 81 e8 73 f6 75
---[ end trace 19b7bd878c0f56ff ]---
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: sctp refcount bug.
2017-07-13 14:36 sctp refcount bug Dave Jones
@ 2017-07-13 14:38 ` Marcelo Ricardo Leitner
2017-07-13 14:56 ` Dave Jones
0 siblings, 1 reply; 3+ messages in thread
From: Marcelo Ricardo Leitner @ 2017-07-13 14:38 UTC (permalink / raw)
To: Dave Jones; +Cc: netdev, Vlad Yasevich, Neil Horman, linux-sctp
On Thu, Jul 13, 2017 at 10:36:39AM -0400, Dave Jones wrote:
> Hit this on Linus' current tree.
>
>
> refcount_t: underflow; use-after-free.
Any tips on how to reproduce this?
Marcelo
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: sctp refcount bug.
2017-07-13 14:38 ` Marcelo Ricardo Leitner
@ 2017-07-13 14:56 ` Dave Jones
0 siblings, 0 replies; 3+ messages in thread
From: Dave Jones @ 2017-07-13 14:56 UTC (permalink / raw)
To: Marcelo Ricardo Leitner; +Cc: netdev, Vlad Yasevich, Neil Horman, linux-sctp
On Thu, Jul 13, 2017 at 11:38:34AM -0300, Marcelo Ricardo Leitner wrote:
> On Thu, Jul 13, 2017 at 10:36:39AM -0400, Dave Jones wrote:
> > Hit this on Linus' current tree.
> >
> >
> > refcount_t: underflow; use-after-free.
>
> Any tips on how to reproduce this?
Only seen it once so far. Will see if I can narrow it down if it
reproduces. It took ~12 hours of fuzzing to find overnight.
Dave
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-07-13 14:56 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-07-13 14:36 sctp refcount bug Dave Jones
2017-07-13 14:38 ` Marcelo Ricardo Leitner
2017-07-13 14:56 ` Dave Jones
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox