From mboxrd@z Thu Jan 1 00:00:00 1970 From: Baozeng Ding Subject: Re: BUG: net/netlink: KASAN: use-after-free in netlink_sock_destruct Date: Fri, 27 May 2016 10:10:57 +0800 Message-ID: References: <1464275215.5939.93.camel@edumazet-glaptop3.roam.corp.google.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: davem@davemloft.net, chamaken@gmail.com, daniel@iogearbox.net, fw@strlen.de, herbert@gondor.apana.org.au, dh.herrmann@gmail.com, christophe.ricard@gmail.com, netdev@vger.kernel.org To: Eric Dumazet Return-path: Received: from mail-pf0-f196.google.com ([209.85.192.196]:33558 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932104AbcE0CLH (ORCPT ); Thu, 26 May 2016 22:11:07 -0400 Received: by mail-pf0-f196.google.com with SMTP id b124so10756028pfb.0 for ; Thu, 26 May 2016 19:11:07 -0700 (PDT) In-Reply-To: <1464275215.5939.93.camel@edumazet-glaptop3.roam.corp.google.com> Sender: netdev-owner@vger.kernel.org List-ID: On 2016/5/26 23:06, Eric Dumazet wrote: > On Thu, 2016-05-26 at 22:48 +0800, Baozeng Ding wrote: >> Hi all, >> I've got the following report use-after-free in netlink_sock_destruct while running syzkaller. >> Unfortunately no reproducer.The kernel version is 4.6 (May 15, on commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a). Thanks. >> >> ================================================================== >> BUG: KASAN: use-after-free in kfree_skb+0x28c/0x310 at addr ffff880036c1179c >> Read of size 4 by task syz-executor/21618 >> ============================================================================= >> BUG skbuff_head_cache (Tainted: G W ): kasan: bad access detected >> ----------------------------------------------------------------------------- >> >> Disabling lock debugging due to kernel taint >> INFO: Slab 0xffffea0000db0400 objects=25 used=3 fp=0xffff880036c116c0 flags=0x1fffc0000004080 >> INFO: Object 0xffff880036c11680 @offset=5760 fp=0xbbbbbbbbbbbbbbbb >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 >> 0000000000000002 ffff88006da07c40 ffffffff8295f5f1 ffff88003e0fc5c0 >> ffff880036c11680 ffffea0000db0400 ffff880036c10000 ffff88006da07c70 >> ffffffff8171144d ffff88003e0fc5c0 ffffea0000db0400 ffff880036c11680 >> Call Trace: >> [< inline >] __dump_stack /lib/dump_stack.c:15 >> [] dump_stack+0xb3/0x112 /lib/dump_stack.c:51 >> [] print_trailer+0x10d/0x190 /mm/slub.c:667 >> [] object_err+0x2f/0x40 /mm/slub.c:674 >> [< inline >] print_address_description /mm/kasan/report.c:179 >> [] kasan_report_error+0x218/0x530 /mm/kasan/report.c:275 >> [] ? debug_check_no_locks_freed+0x290/0x290 /kernel/locking/lockdep.c:4212 >> [< inline >] kasan_report /mm/kasan/report.c:297 >> [] __asan_report_load4_noabort+0x3e/0x40 /mm/kasan/report.c:317 >> [< inline >] ? atomic_read /include/linux/compiler.h:222 >> [] ? kfree_skb+0x28c/0x310 /net/core/skbuff.c:699 >> [< inline >] atomic_read /include/linux/compiler.h:222 >> [] kfree_skb+0x28c/0x310 /net/core/skbuff.c:699 >> [] netlink_sock_destruct+0xeb/0x2b0 /net/netlink/af_netlink.c:334 >> [] ? __netlink_create+0x1d0/0x1d0 /net/netlink/af_netlink.c:577 >> [] sk_destruct+0x4a/0x4f0 /net/core/sock.c:1429 >> [] __sk_free+0x57/0x200 /net/core/sock.c:1459 >> [] sk_free+0x30/0x40 /net/core/sock.c:1470 >> [< inline >] sock_put /include/net/sock.h:1506 >> [] deferred_put_nlk_sk+0x34/0x40 /net/netlink/af_netlink.c:652 >> [< inline >] __rcu_reclaim /kernel/rcu/rcu.h:118 >> [< inline >] rcu_do_batch /kernel/rcu/tree.c:2681 >> [< inline >] invoke_rcu_callbacks /kernel/rcu/tree.c:2947 >> [< inline >] __rcu_process_callbacks /kernel/rcu/tree.c:2914 >> [] rcu_process_callbacks+0xa71/0x11d0 /kernel/rcu/tree.c:2931 >> [< inline >] ? __rcu_reclaim /kernel/rcu/rcu.h:108 >> [< inline >] ? rcu_do_batch /kernel/rcu/tree.c:2681 >> [< inline >] ? invoke_rcu_callbacks /kernel/rcu/tree.c:2947 >> [< inline >] ? __rcu_process_callbacks /kernel/rcu/tree.c:2914 >> [] ? rcu_process_callbacks+0xa1c/0x11d0 /kernel/rcu/tree.c:2931 >> [] ? __netlink_deliver_tap+0x7c0/0x7c0 /net/netlink/af_netlink.c:204 >> [] __do_softirq+0x22b/0x8da /kernel/softirq.c:273 >> [< inline >] invoke_softirq /kernel/softirq.c:350 >> [] irq_exit+0x15d/0x190 /kernel/softirq.c:391 >> [< inline >] exiting_irq /./arch/x86/include/asm/apic.h:658 >> [] smp_apic_timer_interrupt+0x7b/0xa0 /arch/x86/kernel/apic/apic.c:932 >> [] apic_timer_interrupt+0x8c/0xa0 /arch/x86/entry/entry_64.S:454 >> [< inline >] ? atomic_add_return /./arch/x86/include/asm/atomic.h:156 >> [< inline >] ? kref_get /include/linux/kref.h:46 >> [] ? klist_next+0x177/0x400 /lib/klist.c:393 >> [< inline >] ? kref_get /include/linux/kref.h:46 >> [] ? klist_next+0x168/0x400 /lib/klist.c:393 >> [] class_dev_iter_next+0x8b/0xd0 /drivers/base/class.c:324 >> [] ? tty_get_pgrp+0x80/0x80 /drivers/tty/tty_io.c:2525 >> [] class_find_device+0x101/0x1c0 /drivers/base/class.c:428 >> [] ? class_for_each_device+0x1d0/0x1d0 /drivers/base/class.c:375 >> [< inline >] tty_get_device /drivers/tty/tty_io.c:3139 >> [] alloc_tty_struct+0x5fb/0x840 /drivers/tty/tty_io.c:3183 >> [] ? do_SAK_work+0x20/0x20 /drivers/tty/tty_io.c:3112 >> [] ? mutex_lock_interruptible_nested+0x980/0x980 ??:? >> [] tty_init_dev+0x78/0x4b0 /drivers/tty/tty_io.c:1532 >> [< inline >] tty_open_by_driver /drivers/tty/tty_io.c:2065 >> [] tty_open+0xd31/0x1050 /drivers/tty/tty_io.c:2113 >> [] ? tty_init_dev+0x4b0/0x4b0 /drivers/tty/tty_io.c:1543 >> [< inline >] ? spin_unlock /include/linux/spinlock.h:347 >> [] ? chrdev_open+0xbf/0x4c0 /fs/char_dev.c:376 >> [] ? tty_init_dev+0x4b0/0x4b0 /drivers/tty/tty_io.c:1543 >> [] chrdev_open+0x22a/0x4c0 /fs/char_dev.c:388 >> [] ? cdev_put+0x60/0x60 /fs/char_dev.c:338 >> [] ? __fsnotify_parent+0x5e/0x2b0 /fs/notify/fsnotify.c:98 >> [] ? security_file_open+0x89/0x190 /security/security.c:840 >> [] do_dentry_open+0x6a2/0xcb0 /fs/open.c:736 >> [] ? cdev_put+0x60/0x60 /fs/char_dev.c:338 >> [] vfs_open+0x113/0x210 /fs/open.c:849 >> [] ? may_open+0x1cd/0x260 /fs/namei.c:2776 >> [< inline >] do_last /fs/namei.c:3249 >> [] path_openat+0x4ff5/0x5b70 /fs/namei.c:3385 >> [] ? path_lookupat+0x450/0x450 /fs/namei.c:2132 >> [< inline >] ? __raw_spin_unlock /include/linux/spinlock_api_smp.h:153 >> [] ? _raw_spin_unlock+0x22/0x30 /kernel/locking/spinlock.c:183 >> [] ? debug_check_no_locks_freed+0x290/0x290 /kernel/locking/lockdep.c:4212 >> [] ? alloc_debug_processing+0x6e/0x1b0 /mm/slub.c:1085 >> [] do_filp_open+0x18e/0x250 /fs/namei.c:3420 >> [] ? user_path_mountpoint_at+0x40/0x40 /fs/namei.c:2575 >> [] ? do_dup2+0x410/0x410 /fs/file.c:262 >> [< inline >] ? __raw_spin_unlock /include/linux/spinlock_api_smp.h:153 >> [] ? _raw_spin_unlock+0x22/0x30 /kernel/locking/spinlock.c:183 >> [< inline >] ? spin_unlock /include/linux/spinlock.h:347 >> [] ? __alloc_fd+0x1e3/0x530 /fs/file.c:551 >> [] do_sys_open+0x201/0x420 /fs/open.c:1016 >> [] ? filp_open+0x70/0x70 /fs/open.c:987 >> [< inline >] SYSC_open /fs/open.c:1034 >> [] SyS_open+0x2d/0x40 /fs/open.c:1029 >> [] entry_SYSCALL_64_fastpath+0x23/0xc1 /arch/x86/entry/entry_64.S:207 >> Memory state around the buggy address: >> ffff880036c11680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb >> ffff880036c11700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>> ffff880036c11780: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc >> ^ >> ffff880036c11800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >> ffff880036c11880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >> ================================================================== >> ================================================================== >> >> Best Regards, >> Baozeng > Sorry. I forgot to apply the patch. I will check it carefully before reporting a bug in future. Thank you, Eric. > Are you sure this is not a dup of : > > commit 92964c79b357efd980812c4de5c1fd2ec8bb5520 > Author: Herbert Xu > Date: Mon May 16 17:28:16 2016 +0800 > > netlink: Fix dump skb leak/double free > > When we free cb->skb after a dump, we do it after releasing the > lock. This means that a new dump could have started in the time > being and we'll end up freeing their skb instead of ours. > > This patch saves the skb and module before we unlock so we free > the right memory. > > Fixes: 16b304f3404f ("netlink: Eliminate kmalloc in netlink dump operation.") > Reported-by: Baozeng Ding > Signed-off-by: Herbert Xu > Acked-by: Cong Wang > Signed-off-by: David S. Miller > >