From mboxrd@z Thu Jan 1 00:00:00 1970 From: Baozeng Ding Subject: BUG: net/netlink: KASAN: use-after-free in netlink_sock_destruct Date: Thu, 26 May 2016 22:48:59 +0800 Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org To: davem@davemloft.net, chamaken@gmail.com, daniel@iogearbox.net, fw@strlen.de, herbert@gondor.apana.org.au, dh.herrmann@gmail.com, christophe.ricard@gmail.com Return-path: Received: from mail-pf0-f195.google.com ([209.85.192.195]:34010 "EHLO mail-pf0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753925AbcEZOtK (ORCPT ); Thu, 26 May 2016 10:49:10 -0400 Received: by mail-pf0-f195.google.com with SMTP id c84so2197836pfc.1 for ; Thu, 26 May 2016 07:49:10 -0700 (PDT) Sender: netdev-owner@vger.kernel.org List-ID: Hi all, I've got the following report use-after-free in netlink_sock_destruct while running syzkaller. Unfortunately no reproducer.The kernel version is 4.6 (May 15, on commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a). Thanks. ================================================================== BUG: KASAN: use-after-free in kfree_skb+0x28c/0x310 at addr ffff880036c1179c Read of size 4 by task syz-executor/21618 ============================================================================= BUG skbuff_head_cache (Tainted: G W ): kasan: bad access detected ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Slab 0xffffea0000db0400 objects=25 used=3 fp=0xffff880036c116c0 flags=0x1fffc0000004080 INFO: Object 0xffff880036c11680 @offset=5760 fp=0xbbbbbbbbbbbbbbbb Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 0000000000000002 ffff88006da07c40 ffffffff8295f5f1 ffff88003e0fc5c0 ffff880036c11680 ffffea0000db0400 ffff880036c10000 ffff88006da07c70 ffffffff8171144d ffff88003e0fc5c0 ffffea0000db0400 ffff880036c11680 Call Trace: [< inline >] __dump_stack /lib/dump_stack.c:15 [] dump_stack+0xb3/0x112 /lib/dump_stack.c:51 [] print_trailer+0x10d/0x190 /mm/slub.c:667 [] object_err+0x2f/0x40 /mm/slub.c:674 [< inline >] print_address_description /mm/kasan/report.c:179 [] kasan_report_error+0x218/0x530 /mm/kasan/report.c:275 [] ? debug_check_no_locks_freed+0x290/0x290 /kernel/locking/lockdep.c:4212 [< inline >] kasan_report /mm/kasan/report.c:297 [] __asan_report_load4_noabort+0x3e/0x40 /mm/kasan/report.c:317 [< inline >] ? atomic_read /include/linux/compiler.h:222 [] ? kfree_skb+0x28c/0x310 /net/core/skbuff.c:699 [< inline >] atomic_read /include/linux/compiler.h:222 [] kfree_skb+0x28c/0x310 /net/core/skbuff.c:699 [] netlink_sock_destruct+0xeb/0x2b0 /net/netlink/af_netlink.c:334 [] ? __netlink_create+0x1d0/0x1d0 /net/netlink/af_netlink.c:577 [] sk_destruct+0x4a/0x4f0 /net/core/sock.c:1429 [] __sk_free+0x57/0x200 /net/core/sock.c:1459 [] sk_free+0x30/0x40 /net/core/sock.c:1470 [< inline >] sock_put /include/net/sock.h:1506 [] deferred_put_nlk_sk+0x34/0x40 /net/netlink/af_netlink.c:652 [< inline >] __rcu_reclaim /kernel/rcu/rcu.h:118 [< inline >] rcu_do_batch /kernel/rcu/tree.c:2681 [< inline >] invoke_rcu_callbacks /kernel/rcu/tree.c:2947 [< inline >] __rcu_process_callbacks /kernel/rcu/tree.c:2914 [] rcu_process_callbacks+0xa71/0x11d0 /kernel/rcu/tree.c:2931 [< inline >] ? __rcu_reclaim /kernel/rcu/rcu.h:108 [< inline >] ? rcu_do_batch /kernel/rcu/tree.c:2681 [< inline >] ? invoke_rcu_callbacks /kernel/rcu/tree.c:2947 [< inline >] ? __rcu_process_callbacks /kernel/rcu/tree.c:2914 [] ? rcu_process_callbacks+0xa1c/0x11d0 /kernel/rcu/tree.c:2931 [] ? __netlink_deliver_tap+0x7c0/0x7c0 /net/netlink/af_netlink.c:204 [] __do_softirq+0x22b/0x8da /kernel/softirq.c:273 [< inline >] invoke_softirq /kernel/softirq.c:350 [] irq_exit+0x15d/0x190 /kernel/softirq.c:391 [< inline >] exiting_irq /./arch/x86/include/asm/apic.h:658 [] smp_apic_timer_interrupt+0x7b/0xa0 /arch/x86/kernel/apic/apic.c:932 [] apic_timer_interrupt+0x8c/0xa0 /arch/x86/entry/entry_64.S:454 [< inline >] ? atomic_add_return /./arch/x86/include/asm/atomic.h:156 [< inline >] ? kref_get /include/linux/kref.h:46 [] ? klist_next+0x177/0x400 /lib/klist.c:393 [< inline >] ? kref_get /include/linux/kref.h:46 [] ? klist_next+0x168/0x400 /lib/klist.c:393 [] class_dev_iter_next+0x8b/0xd0 /drivers/base/class.c:324 [] ? tty_get_pgrp+0x80/0x80 /drivers/tty/tty_io.c:2525 [] class_find_device+0x101/0x1c0 /drivers/base/class.c:428 [] ? class_for_each_device+0x1d0/0x1d0 /drivers/base/class.c:375 [< inline >] tty_get_device /drivers/tty/tty_io.c:3139 [] alloc_tty_struct+0x5fb/0x840 /drivers/tty/tty_io.c:3183 [] ? do_SAK_work+0x20/0x20 /drivers/tty/tty_io.c:3112 [] ? mutex_lock_interruptible_nested+0x980/0x980 ??:? [] tty_init_dev+0x78/0x4b0 /drivers/tty/tty_io.c:1532 [< inline >] tty_open_by_driver /drivers/tty/tty_io.c:2065 [] tty_open+0xd31/0x1050 /drivers/tty/tty_io.c:2113 [] ? tty_init_dev+0x4b0/0x4b0 /drivers/tty/tty_io.c:1543 [< inline >] ? spin_unlock /include/linux/spinlock.h:347 [] ? chrdev_open+0xbf/0x4c0 /fs/char_dev.c:376 [] ? tty_init_dev+0x4b0/0x4b0 /drivers/tty/tty_io.c:1543 [] chrdev_open+0x22a/0x4c0 /fs/char_dev.c:388 [] ? cdev_put+0x60/0x60 /fs/char_dev.c:338 [] ? __fsnotify_parent+0x5e/0x2b0 /fs/notify/fsnotify.c:98 [] ? security_file_open+0x89/0x190 /security/security.c:840 [] do_dentry_open+0x6a2/0xcb0 /fs/open.c:736 [] ? cdev_put+0x60/0x60 /fs/char_dev.c:338 [] vfs_open+0x113/0x210 /fs/open.c:849 [] ? may_open+0x1cd/0x260 /fs/namei.c:2776 [< inline >] do_last /fs/namei.c:3249 [] path_openat+0x4ff5/0x5b70 /fs/namei.c:3385 [] ? path_lookupat+0x450/0x450 /fs/namei.c:2132 [< inline >] ? __raw_spin_unlock /include/linux/spinlock_api_smp.h:153 [] ? _raw_spin_unlock+0x22/0x30 /kernel/locking/spinlock.c:183 [] ? debug_check_no_locks_freed+0x290/0x290 /kernel/locking/lockdep.c:4212 [] ? alloc_debug_processing+0x6e/0x1b0 /mm/slub.c:1085 [] do_filp_open+0x18e/0x250 /fs/namei.c:3420 [] ? user_path_mountpoint_at+0x40/0x40 /fs/namei.c:2575 [] ? do_dup2+0x410/0x410 /fs/file.c:262 [< inline >] ? __raw_spin_unlock /include/linux/spinlock_api_smp.h:153 [] ? _raw_spin_unlock+0x22/0x30 /kernel/locking/spinlock.c:183 [< inline >] ? spin_unlock /include/linux/spinlock.h:347 [] ? __alloc_fd+0x1e3/0x530 /fs/file.c:551 [] do_sys_open+0x201/0x420 /fs/open.c:1016 [] ? filp_open+0x70/0x70 /fs/open.c:987 [< inline >] SYSC_open /fs/open.c:1034 [] SyS_open+0x2d/0x40 /fs/open.c:1029 [] entry_SYSCALL_64_fastpath+0x23/0xc1 /arch/x86/entry/entry_64.S:207 Memory state around the buggy address: ffff880036c11680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff880036c11700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff880036c11780: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff880036c11800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff880036c11880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ================================================================== Best Regards, Baozeng