From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dmitry Vyukov Subject: Re: net/packet: use-after-free in packet_rcv_fanout Date: Mon, 13 Feb 2017 16:17:12 +0100 Message-ID: References: <1486696765.7793.119.camel@edumazet-glaptop3.roam.corp.google.com> <1486697003.7793.121.camel@edumazet-glaptop3.roam.corp.google.com> <1486749566.7793.150.camel@edumazet-glaptop3.roam.corp.google.com> <1486749763.7793.152.camel@edumazet-glaptop3.roam.corp.google.com> <20170213014239.GA21934@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Cc: Eric Dumazet , Cong Wang , Anoob Soman , David Miller , Willem de Bruijn , Eric Dumazet , Daniel Borkmann , jarno@ovn.org, Philip Pettersson , weongyo.linux@gmail.com, netdev , syzkaller To: Sowmini Varadhan Return-path: Received: from mail-vk0-f54.google.com ([209.85.213.54]:35878 "EHLO mail-vk0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752243AbdBMPRe (ORCPT ); Mon, 13 Feb 2017 10:17:34 -0500 Received: by mail-vk0-f54.google.com with SMTP id t8so62312790vke.3 for ; Mon, 13 Feb 2017 07:17:33 -0800 (PST) In-Reply-To: <20170213014239.GA21934@oracle.com> Sender: netdev-owner@vger.kernel.org List-ID: On Mon, Feb 13, 2017 at 2:42 AM, Sowmini Varadhan wrote: > On (02/10/17 10:02), Eric Dumazet wrote: >> At least, Anoob patch is making a step into the right direction ;) >> https://patchwork.ozlabs.org/patch/726532/ > > I've not been able to reproduce Dmitry's panic (though I did not try > very hard either) but there's a call to fanout_release from packet_release > before the synchronize_net() - I wonder if this could end up kfree'ing f > when there are threads in the middle of dev_queue_xmit_nit(). Another similar one: BUG: KASAN: use-after-free in fanout_demux_rollover+0x681/0x6b0 net/packet/af_packet.c:1387 at addr ffff8801cf083df0 Read of size 8 by task syz-executor1/21190 CPU: 1 PID: 21190 Comm: syz-executor1 Not tainted 4.9.0 #7 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c2616850 ffffffff8234ce1f ffffffff00000001 1ffff100384c2c9d ffffed00384c2c95 0000000041b58ab3 ffffffff84b38258 ffffffff8234cb31 ffffe8ffffd2b3b8 0000000000000000 ffffffff84aef298 ffffffff8155e0a0 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0x2ee/0x3ef lib/dump_stack.c:51 [] kasan_object_err+0x1c/0x70 mm/kasan/report.c:162 [] print_address_description mm/kasan/report.c:200 [inline] [] kasan_report_error mm/kasan/report.c:289 [inline] [] kasan_report.part.2+0x1e5/0x4b0 mm/kasan/report.c:311 [] kasan_report mm/kasan/report.c:332 [inline] [] __asan_report_load8_noabort+0x29/0x30 mm/kasan/report.c:332 [] fanout_demux_rollover+0x681/0x6b0 net/packet/af_packet.c:1387 [] packet_rcv_fanout+0x56e/0x800 net/packet/af_packet.c:1473 [] dev_queue_xmit_nit+0x73a/0xa90 net/core/dev.c:1904 [] xmit_one net/core/dev.c:2910 [inline] [] dev_hard_start_xmit+0x16b/0xab0 net/core/dev.c:2930 [] __dev_queue_xmit+0x16e4/0x1e70 net/core/dev.c:3391 [] dev_queue_xmit+0x17/0x20 net/core/dev.c:3424 [] neigh_hh_output include/net/neighbour.h:468 [inline] [] dst_neigh_output include/net/dst.h:462 [inline] [] ip_finish_output2+0xf0e/0x1520 net/ipv4/ip_output.c:224 [] ip_finish_output+0x909/0xc60 net/ipv4/ip_output.c:305 [] NF_HOOK_COND include/linux/netfilter.h:246 [inline] [] ip_output+0x1f7/0x860 net/ipv4/ip_output.c:379 [] dst_output include/net/dst.h:501 [inline] [] ip_local_out+0x95/0x170 net/ipv4/ip_output.c:123 [] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1461 [] ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1481 [] raw_sendmsg+0x19c0/0x2070 net/ipv4/raw.c:650 [] inet_sendmsg+0x380/0x580 net/ipv4/af_inet.c:734 [] sock_sendmsg_nosec net/socket.c:621 [inline] [] sock_sendmsg+0xca/0x110 net/socket.c:631 [] SYSC_sendto+0x660/0x810 net/socket.c:1656 [] SyS_sendto+0x40/0x50 net/socket.c:1624 [] entry_SYSCALL_64_fastpath+0x1f/0xc2 Object at ffff8801cf0836c0, in cache kmalloc-2048 size: 2048 Allocated: PID = 21136 [ 142.233815] [] save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 [ 142.241057] [] save_stack+0x43/0xd0 mm/kasan/kasan.c:495 [ 142.247780] [] set_track mm/kasan/kasan.c:507 [inline] [ 142.247780] [] kasan_kmalloc+0xaa/0xd0 mm/kasan/kasan.c:598 [ 142.254778] [] __do_kmalloc mm/slab.c:3737 [inline] [ 142.254778] [] __kmalloc+0x12c/0x690 mm/slab.c:3746 [ 142.261585] [] kmalloc include/linux/slab.h:497 [inline] [ 142.261585] [] sk_prot_alloc+0x101/0x2a0 net/core/sock.c:1333 [ 142.268791] [] sk_alloc+0x8c/0x460 net/core/sock.c:1389 [ 142.275425] [] packet_create+0x163/0xb00 net/packet/af_packet.c:3181 [ 142.282590] [] __sock_create+0x4e4/0x870 net/socket.c:1168 [ 142.289754] [] sock_create net/socket.c:1208 [inline] [ 142.289754] [] SYSC_socket net/socket.c:1238 [inline] [ 142.289754] [] SyS_socket+0xf9/0x230 net/socket.c:1218 [ 142.296558] [] entry_SYSCALL_64_fastpath+0x1f/0xc2 Freed: PID = 21163 [ 142.309281] [] save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 [ 142.316556] [] save_stack+0x43/0xd0 mm/kasan/kasan.c:495 [ 142.323282] [] set_track mm/kasan/kasan.c:507 [inline] [ 142.323282] [] kasan_slab_free+0x6f/0xb0 mm/kasan/kasan.c:571 [ 142.330450] [] __cache_free mm/slab.c:3515 [inline] [ 142.330450] [] kfree+0xd3/0x250 mm/slab.c:3832 [ 142.336840] [] sk_prot_free net/core/sock.c:1372 [inline] [ 142.336840] [] __sk_destruct+0x5a5/0x6a0 net/core/sock.c:1445 [ 142.344013] [] sk_destruct+0x47/0x80 net/core/sock.c:1453 [ 142.350819] [] __sk_free+0x57/0x230 net/core/sock.c:1461 [ 142.357535] [] sk_free+0x23/0x30 net/core/sock.c:1472 [ 142.364024] [] sock_put include/net/sock.h:1591 [inline] [ 142.364024] [] packet_release+0x7ac/0x970 net/packet/af_packet.c:3021 [ 142.371267] [] sock_release+0x8d/0x1e0 net/socket.c:585 [ 142.378247] [] sock_close+0x16/0x20 net/socket.c:1032 [ 142.384968] [] __fput+0x332/0x7f0 fs/file_table.c:208 [ 142.391512] [] ____fput+0x15/0x20 fs/file_table.c:244 [ 142.398088] [] task_work_run+0x18a/0x260 kernel/task_work.c:116 [ 142.405266] [] exit_task_work include/linux/task_work.h:21 [inline] [ 142.405266] [] do_exit+0x18ef/0x2890 kernel/exit.c:830 [ 142.412090] [] do_group_exit+0x149/0x420 kernel/exit.c:934 [ 142.419243] [] get_signal+0x7e0/0x1820 kernel/signal.c:2307 [ 142.426220] [] do_signal+0xd2/0x2120 arch/x86/kernel/signal.c:807 [ 142.433057] [] exit_to_usermode_loop+0x200/0x2a0 arch/x86/entry/common.c:156 [ 142.440908] [] prepare_exit_to_usermode arch/x86/entry/common.c:190 [inline] [ 142.440908] [] syscall_return_slowpath+0x4d3/0x570 arch/x86/entry/common.c:259 [ 142.448950] [] entry_SYSCALL_64_fastpath+0xc0/0xc2 Memory state around the buggy address: ffff8801cf083c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801cf083d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8801cf083d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8801cf083e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801cf083e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================