Re: tty, fbcon: use-after-free in fbcon_invert_region

[Dmitry Vyukov]

On Sat, Sep 3, 2016 at 9:20 PM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
> Hello,
>
> The following program causes use-after-free in fbcon_invert_region:
>
> https://gist.githubusercontent.com/dvyukov/d657f9a9ca39f34c430dcf63ec1153ac/raw/04e1b94aef0fc9eb770d11373b568980ecaa7f34/gistfile1.txt
>
> ==================================================================
> BUG: KASAN: use-after-free in fbcon_invert_region+0x1cc/0x1f0 at addr
> ffff88006cc3f51e
> Read of size 2 by task a.out/4240
> CPU: 0 PID: 4240 Comm: a.out Not tainted 4.8.0-rc3-next-20160825+ #10
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>  ffffffff886b6fe0 ffff88003699f790 ffffffff82db3759 ffffffff8a0ae640
>  fffffbfff10d6dfc ffff88003e800100 ffff88006cc3f500 ffff88006cc3f520
>  0000000000000000 ffff88006cc3f51e ffff88003699f7b8 ffffffff81809e7c
>
> Call Trace:
>  [<ffffffff8180a474>] __asan_report_load2_noabort+0x14/0x20
> mm/kasan/report.c:325
>  [<ffffffff82fdbc8c>] fbcon_invert_region+0x1cc/0x1f0
> drivers/video/console/fbcon.c:2750
>  [<ffffffff8327ce72>] invert_screen+0x192/0x630 drivers/tty/vt/vt.c:470
>  [<     inline     >] highlight drivers/tty/vt/selection.c:50
>  [<ffffffff8326037c>] clear_selection+0x4c/0x60 drivers/tty/vt/selection.c:76
>  [<ffffffff8327374e>] hide_cursor+0x24e/0x2d0 drivers/tty/vt/vt.c:599
>  [<ffffffff83276207>] redraw_screen+0x2e7/0x840 drivers/tty/vt/vt.c:682
>  [<ffffffff83278b0c>] vc_do_resize+0xebc/0x1160 drivers/tty/vt/vt.c:952
>  [<ffffffff83278eba>] vt_resize+0xaa/0xe0 drivers/tty/vt/vt.c:992
>  [<     inline     >] tiocswinsz drivers/tty/tty_io.c:2378
>  [<ffffffff83224e71>] tty_ioctl+0x10c1/0x21e0 drivers/tty/tty_io.c:2892
>  [<     inline     >] vfs_ioctl fs/ioctl.c:43
>  [<ffffffff818a1c6c>] do_vfs_ioctl+0x18c/0x1080 fs/ioctl.c:675
>  [<     inline     >] SYSC_ioctl fs/ioctl.c:690
>  [<ffffffff818a2bef>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:681
>  [<ffffffff86e10480>] entry_SYSCALL_64_fastpath+0x23/0xc1
> arch/x86/entry/entry_64.S:208
> Object at ffff88006cc3f500, in cache kmalloc-32 size: 32
>
> Allocated:
> PID = 3233
>  [<     inline     >] kmalloc ./include/linux/slab.h:490
>  [<     inline     >] kzalloc ./include/linux/slab.h:636
>  [<ffffffff82b85834>] aa_alloc_task_context+0x54/0x90
> security/apparmor/context.c:40
>  [<ffffffff82b99e3d>] apparmor_cred_prepare+0x1d/0xb0 security/apparmor/lsm.c:76
>  [<ffffffff82acf12d>] security_prepare_creds+0x7d/0xb0 security/security.c:912
>  [<ffffffff813fb355>] prepare_kernel_cred+0x375/0x650 kernel/cred.c:630
>  [<ffffffff813cded9>] call_usermodehelper_exec_async+0xb9/0x460
> kernel/kmod.c:232
>  [<ffffffff86e1070a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
>
> Freed:
> PID = 1693
>  [<     inline     >] __cache_free mm/slab.c:3520
>  [<ffffffff81807813>] kfree+0xc3/0x2a0 mm/slab.c:3837
>  [<ffffffff8175f108>] kzfree+0x28/0x30 mm/slab_common.c:1323
>  [<ffffffff82b85991>] aa_free_task_context+0x121/0x1d0
> security/apparmor/context.c:54
>  [<ffffffff82b99f79>] apparmor_cred_free+0x39/0x80 security/apparmor/lsm.c:51
>  [<ffffffff82acf078>] security_cred_free+0x48/0x80 security/security.c:907
>  [<ffffffff813f8224>] put_cred_rcu+0xe4/0x3e0 kernel/cred.c:116
>  [<     inline     >] __rcu_reclaim kernel/rcu/rcu.h:118
>  [<     inline     >] rcu_do_batch kernel/rcu/tree.c:2777
>  [<     inline     >] invoke_rcu_callbacks kernel/rcu/tree.c:3041
>  [<     inline     >] __rcu_process_callbacks kernel/rcu/tree.c:3008
>  [<ffffffff814e7e3b>] rcu_process_callbacks+0xdbb/0x1560 kernel/rcu/tree.c:3025
>  [<ffffffff86e1358c>] __do_softirq+0x25c/0xa3e kernel/softirq.c:273
> Memory state around the buggy address:
>  ffff88006cc3f400: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
>  ffff88006cc3f480: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc
>>ffff88006cc3f500: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
>                             ^
>  ffff88006cc3f580: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
>  ffff88006cc3f600: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
> ==================================================================
>
>
> I am also hitting similar bugs all over fbcon:
>
> BUG: KASAN: slab-out-of-bounds in fbcon_putcs+0x444/0x4b0 at addr
> ffff8800384e58a8
>
> https://gist.githubusercontent.com/dvyukov/645a5f48b735fb384de7ea35fe1748ea/raw/3690a8b2c82a3b8fd7d07f4602a166f5756c3749/gistfile1.txt
>
> BUG: KASAN: slab-out-of-bounds in bit_putcs+0xcd6/0xd70 at addr ffff88006abad8e6
>
> https://gist.githubusercontent.com/dvyukov/2d909f2673eafbc35f7f17f95c395217/raw/83f4eb0193226d51c546015cddee4b6a697015b3/gistfile1.txt
>
> BUG: KASAN: use-after-free in fbcon_putcs+0x444/0x4b0 at addr ffff8800644bd820
>
> https://gist.githubusercontent.com/dvyukov/286cdf2d3f9c6956ec9055dad0cf7a2a/raw/f7e0a380be364afd0c2c4c54ff5661e451fb143d/gistfile1.txt
>
> BUG: KASAN: slab-out-of-bounds in do_update_region+0x642/0x670 at addr
> ffff8800661c56ac
>
> https://gist.githubusercontent.com/dvyukov/7fd9d858ea38e8131e21a0377435c32c/raw/5d59989e05b4e39bb5ee90f49658674fa9db89ad/gistfile1.txt
>
> On 0f98f121e1670eaa2a2fbb675e07d6ba7f0e146f of linux-next.


A friendly ping. This still happens at insane rate on
a6930aaee06755d1bdcfd943fbf614e4d92bb0c7 (Oct 5).