net/xfrm: stack out-of-bounds in xfrm_flowi_sport

[Dmitry Vyukov]

Hello,

The following program triggers stack out-of-bounds in xfrm_flowi_sport:


BUG: KASAN: stack-out-of-bounds in xfrm_flowi_sport
include/net/xfrm.h:862 [inline] at addr ffff8800677df796
BUG: KASAN: stack-out-of-bounds in __xfrm6_selector_match
net/xfrm/xfrm_policy.c:89 [inline] at addr ffff8800677df796
BUG: KASAN: stack-out-of-bounds in xfrm_selector_match+0xc94/0xe40
net/xfrm/xfrm_policy.c:101 at addr ffff8800677df796
Read of size 2 by task a.out/3338
page:ffffea00016a38c8 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x100000000000000()
raw: 0100000000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 dead000000000200 0000000000000000
page dumped because: kasan: bad access detected
CPU: 0 PID: 3338 Comm: a.out Tainted: G    B           4.10.0-rc8+ #218
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __asan_report_load2_noabort+0x29/0x30 mm/kasan/report.c:329
 xfrm_flowi_sport include/net/xfrm.h:862 [inline]
 __xfrm6_selector_match net/xfrm/xfrm_policy.c:89 [inline]
 xfrm_selector_match+0xc94/0xe40 net/xfrm/xfrm_policy.c:101
 xfrm_sk_policy_lookup+0x1bb/0x540 net/xfrm/xfrm_policy.c:1259
 xfrm_lookup+0x215/0x10f0 net/xfrm/xfrm_policy.c:2256
 xfrm_lookup_route+0x39/0x1a0 net/xfrm/xfrm_policy.c:2390
 ip_route_output_flow+0x7f/0xa0 net/ipv4/route.c:2447
 udp_sendmsg+0x162b/0x2b80 net/ipv4/udp.c:1027
 udpv6_sendmsg+0x10a9/0x3170 net/ipv6/udp.c:1065
 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
 sock_sendmsg_nosec net/socket.c:635 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:645
 SYSC_sendto+0x660/0x810 net/socket.c:1687
 SyS_sendto+0x40/0x50 net/socket.c:1655
 entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x436ed3
RSP: 002b:00007fff6d081748 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000401860 RCX: 0000000000436ed3
RDX: 000000000000008f RSI: 0000000020003f71 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000020003000 R09: 0000000000000010
R10: 0000000000040084 R11: 0000000000000246 R12: 00000000004002b0
R13: 0000000000401860 R14: 00000000004018f0 R15: 0000000000000000
Memory state around the buggy address:
 ffff8800677df680: f1 00 f2 f2 f2 f2 f2 f2 f2 f8 f2 f2 f2 f2 f2 f2
 ffff8800677df700: f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00
>ffff8800677df780: f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 f2 f2
                         ^
 ffff8800677df800: f2 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00
 ffff8800677df880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================


// autogenerated by syzkaller (http://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/mman.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <linux/in.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main()
{
  mmap((void*)0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, -1, 0);
  int sock = socket(AF_INET6, SOCK_DGRAM, IPPROTO_IP);
  (*(uint64_t*)0x20000098 = (uint64_t)0x20b50000);
  (*(uint32_t*)0x200000a0 = (uint32_t)0x1);
  (*(uint64_t*)0x20000000 = (uint64_t)0x20005000);
  (*(uint64_t*)0x20000008 = (uint64_t)0x20002fdc);
  (*(uint64_t*)0x20000010 = (uint64_t)0x20001ff8);
  (*(uint64_t*)0x20000018 = (uint64_t)0x20004ff0);
  (*(uint32_t*)0x20000020 = (uint32_t)0x1);
  (*(uint32_t*)0x20000024 = (uint32_t)0x0);
  (*(uint32_t*)0x20000028 = (uint32_t)0x2);
  (*(uint32_t*)0x2000002c = (uint32_t)0x0);
  (*(uint32_t*)0x20000030 = (uint32_t)0x0);
  (*(uint32_t*)0x20000034 = (uint32_t)0x0);
  (*(uint32_t*)0x20000038 = (uint32_t)0x0);
  (*(uint32_t*)0x2000003c = (uint32_t)0x0);
  setsockopt(sock, 0x29ul, 0x23ul, (void*)0x20000000ul, 0x264ul);
  (*(uint16_t*)0x20003000 = (uint16_t)0x2);
  (*(uint16_t*)0x20003002 = (uint16_t)0x214e);
  (*(uint32_t*)0x20003004 = (uint32_t)0x0);
  (*(uint8_t*)0x20003008 = (uint8_t)0x0);
  (*(uint8_t*)0x20003009 = (uint8_t)0x0);
  (*(uint8_t*)0x2000300a = (uint8_t)0x0);
  (*(uint8_t*)0x2000300b = (uint8_t)0x0);
  (*(uint8_t*)0x2000300c = (uint8_t)0x0);
  (*(uint8_t*)0x2000300d = (uint8_t)0x0);
  (*(uint8_t*)0x2000300e = (uint8_t)0x0);
  (*(uint8_t*)0x2000300f = (uint8_t)0x0);
  sendto(sock, (void*)0x20003f71ul, 0x8ful, 0x40084ul,
(void*)0x20003000ul, 0x10ul);
  return 0;
}


On commit 7089db84e356562f8ba737c29e472cc42d530dbc.


struct flowi4 fl4_stack allocated on stack in udp_sendmsg is being
casted to larger struct flowi and then accessed.