net: llc: NULL ptr deref in llc_ui_sendmsg

[Sasha Levin]

Hi all,

While fuzzing with trinity inside a KVM tools guest running the latest -next
kernel I've stumbled on the following spew:

[  269.531162] BUG: unable to handle kernel NULL pointer dereference at 000000000000021e
[  269.531217] IP: llc_ui_sendmsg (net/llc/af_llc.c:912)
[  269.531232] PGD b6584067 PUD b6585067 PMD 0
[  269.531246] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[  269.531287] Dumping ftrace buffer:
[  269.531451]    (ftrace buffer empty)
[  269.531472] Modules linked in:
[  269.531483] CPU: 10 PID: 9450 Comm: trinity-c77 Not tainted 3.15.0-rc8-next-20140605-sasha-00021-ga95d8d2 #593
[  269.531487] task: ffff8800b6563000 ti: ffff8800b659c000 task.ti: ffff8800b659c000
[  269.531498] RIP: llc_ui_sendmsg (net/llc/af_llc.c:912)
[  269.531501] RSP: 0018:ffff8800b659fcb8  EFLAGS: 00010286
[  269.531505] RAX: 0000000000000000 RBX: ffff88006b5b8000 RCX: 0000000000000006
[  269.531510] RDX: 0000000000007110 RSI: ffffffff9584f0f3 RDI: ffffffff957e75bd
[  269.531515] RBP: ffff8800b659fd38 R08: 0000000000000000 R09: 0000000000000000
[  269.531519] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88006e177900
[  269.531521] R13: ffff8800b659feb0 R14: 00000000007ffff7 R15: ffff8800b659fe78
[  269.531524] FS:  00007f2b119bb700(0000) GS:ffff880292e00000(0000) knlGS:0000000000000000
[  269.531528] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  269.531530] CR2: 000000000000021e CR3: 00000000b6583000 CR4: 00000000000006a0
[  269.531610] DR0: 00000000006d6000 DR1: 0000000000000000 DR2: 0000000000000000
[  269.531612] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000070602
[  269.531616] Stack:
[  269.531686]  ffff8800b659fcc8 ffffffff911c488e ffff8800b659fce8 ffffffff00004002
[  269.531695]  00000000b648d118 ffffffff912b923a ffff8800b659fd88 ffffffff911cb5be
[  269.531709]  ffff880000000000 ffffffff911a6ba8 000000000049c24f ffff8800b659fd48
[  269.531712] Call Trace:
[  269.531730] ? put_lock_stats.isra.12 (./arch/x86/include/asm/preempt.h:98 kernel/locking/lockdep.c:254)
[  269.531746] ? might_fault (mm/memory.c:3735)
[  269.531755] ? lock_release_non_nested (kernel/locking/lockdep.c:3397)
[  269.531771] ? sched_clock_cpu (kernel/sched/clock.c:311)
[  269.531779] sock_sendmsg (net/socket.c:654)
[  269.531787] ? might_fault (mm/memory.c:3736)
[  269.531793] ? might_fault (mm/memory.c:3735)
[  269.531800] ? move_addr_to_kernel (./arch/x86/include/asm/uaccess.h:713 net/socket.c:197)
[  269.531805] SYSC_sendto (net/socket.c:1812)
[  269.531819] ? syscall_trace_enter (include/trace/events/syscalls.h:16 arch/x86/kernel/ptrace.c:1488)
[  269.531827] SyS_sendto (net/socket.c:1779)
[  269.531837] tracesys (arch/x86/kernel/entry_64.S:542)
[ 269.532403] Code: c6 c0 37 b2 98 4c 89 ef e8 95 a5 b6 fd 85 c0 74 d5 90 48 8b 83 f8 01 00 00 f6 c4 01 75 1c 48 8b 83 28 05 00 00 66 41 83 7d 04 00 <0f> b7 90 1e 02 00 00 75 1e eb 24 0f 1f 40 00 49 8b 7c 24 20 4c
All code
========
   0:	c6 c0 37             	mov    $0x37,%al
   3:	b2 98                	mov    $0x98,%dl
   5:	4c 89 ef             	mov    %r13,%rdi
   8:	e8 95 a5 b6 fd       	callq  0xfffffffffdb6a5a2
   d:	85 c0                	test   %eax,%eax
   f:	74 d5                	je     0xffffffffffffffe6
  11:	90                   	nop
  12:	48 8b 83 f8 01 00 00 	mov    0x1f8(%rbx),%rax
  19:	f6 c4 01             	test   $0x1,%ah
  1c:	75 1c                	jne    0x3a
  1e:	48 8b 83 28 05 00 00 	mov    0x528(%rbx),%rax
  25:	66 41 83 7d 04 00    	cmpw   $0x0,0x4(%r13)
  2b:*	0f b7 90 1e 02 00 00 	movzwl 0x21e(%rax),%edx		<-- trapping instruction
  32:	75 1e                	jne    0x52
  34:	eb 24                	jmp    0x5a
  36:	0f 1f 40 00          	nopl   0x0(%rax)
  3a:	49 8b 7c 24 20       	mov    0x20(%r12),%rdi
  3f:	4c                   	rex.WR
	...

Code starting with the faulting instruction
===========================================
   0:	0f b7 90 1e 02 00 00 	movzwl 0x21e(%rax),%edx
   7:	75 1e                	jne    0x27
   9:	eb 24                	jmp    0x2f
   b:	0f 1f 40 00          	nopl   0x0(%rax)
   f:	49 8b 7c 24 20       	mov    0x20(%r12),%rdi
  14:	4c                   	rex.WR
	...
[  269.532565] RIP llc_ui_sendmsg (net/llc/af_llc.c:912)
[  269.532572]  RSP <ffff8800b659fcb8>
[  269.532575] CR2: 000000000000021e


Thanks,
Sasha
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/