Re: net/rose: null-ptr-deref in rose_route_frame

From: Andrey Konovalov
Date: Wed Jun 21 2017 - 11:02:22 EST

Next message: Dennis Zhou: "[no subject]"
Previous message: Zi Yan: "Re: [PATCH v7 05/10] mm: thp: enable thp migration in generic path"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Fri, Apr 21, 2017 at 3:29 PM, Andrey Konovalov <andreyknvl@xxxxxxxxxx> wrote:
> Hi,
>
> I've got the following error report while fuzzing the kernel with syzkaller.
>
> On commit 4f7d029b9bf009fbee76bb10c0c4351a1870d2f3 (4.11-rc7).
>
> rose_xmit calls rose_route_frame(skb, ax25 = NULL), and
> rose_route_frame then dereferences ax25 when doing
> ax25cmp(&ax25->dest_addr, &rose_neigh->callsign).

Still see this on 9705596d08ac87c18aee32cc97f2783b7d14624e (4.12-rc6+).

Now have a C reproducer, attached.

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 4282 Comm: a.out Not tainted 4.12.0-rc6+ #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880064250000 task.stack: ffff880069d10000
RIP: 0010:ax25cmp+0x44/0x160 net/ax25/ax25_addr.c:122
RSP: 0018:ffff880069d15130 EFLAGS: 00010202
RAX: ffff880064250000 RBX: ffff880067d23680 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000017
RBP: ffff880069d15168 R08: dffffc0000000000 R09: 0000000000000002
R10: ffff880069d14960 R11: dffffc0000000000 R12: dffffc0000000000
R13: 000000000000001d R14: ffff880067d23688 R15: 0000000000000017
FS: 00007f2fbf36c700(0000) GS:ffff88006ca00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010ff0 CR3: 0000000068492000 CR4: 00000000000006f0
Call Trace:
rose_route_frame+0x3b6/0x19f0 net/rose/rose_route.c:883
rose_xmit+0x84/0x180 net/rose/rose_dev.c:110
__netdev_start_xmit ./include/linux/netdevice.h:4004
netdev_start_xmit ./include/linux/netdevice.h:4013
xmit_one net/core/dev.c:2914
dev_hard_start_xmit+0x253/0xad0 net/core/dev.c:2930
__dev_queue_xmit+0x1ff2/0x2820 net/core/dev.c:3400
dev_queue_xmit+0x1c/0x20 net/core/dev.c:3433
arp_xmit_finish net/ipv4/arp.c:629
NF_HOOK ./include/linux/netfilter.h:257
arp_xmit+0xdb/0x580 net/ipv4/arp.c:638
arp_send_dst.part.17+0x9e/0xc0 net/ipv4/arp.c:316
arp_send_dst net/ipv4/arp.c:389
arp_solicit+0x929/0x10f0 net/ipv4/arp.c:388
neigh_probe+0xcb/0x110 net/core/neighbour.c:865
__neigh_event_send+0xa61/0xf40 net/core/neighbour.c:1021
neigh_event_send ./include/net/neighbour.h:432
neigh_resolve_output+0x6e6/0xa40 net/core/neighbour.c:1300
neigh_output ./include/net/neighbour.h:479
ip_finish_output2+0x968/0x15e0 net/ipv4/ip_output.c:228
ip_finish_output+0xa3a/0xe00 net/ipv4/ip_output.c:316
NF_HOOK_COND ./include/linux/netfilter.h:246
ip_output+0x1fb/0x7b0 net/ipv4/ip_output.c:404
dst_output ./include/net/dst.h:492
ip_local_out+0x9a/0x170 net/ipv4/ip_output.c:124
ip_queue_xmit+0x9ad/0x1a10 net/ipv4/ip_output.c:503
sctp_v4_xmit+0x10d/0x140 net/sctp/protocol.c:994
sctp_packet_transmit+0x2161/0x3510 net/sctp/output.c:637
sctp_outq_flush+0xae3/0x3fa0 net/sctp/outqueue.c:895
sctp_outq_uncork+0x5f/0x70 net/sctp/outqueue.c:760
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1773
sctp_side_effects net/sctp/sm_sideeffect.c:1175
sctp_do_sm+0x599/0x6a50 net/sctp/sm_sideeffect.c:1147
sctp_primitive_ASSOCIATE+0xa2/0xd0 net/sctp/primitive.c:88
__sctp_connect+0x8cc/0xea0 net/sctp/socket.c:1206
sctp_connect+0xb9/0xf0 net/sctp/socket.c:4135
inet_dgram_connect+0x117/0x1f0 net/ipv4/af_inet.c:540
SYSC_connect+0x251/0x590 net/socket.c:1588
SyS_connect+0x29/0x30 net/socket.c:1569
entry_SYSCALL_64_fastpath+0x1f/0xbe arch/x86/entry/entry_64.S:203
RIP: 0033:0x7f2fbea7eb79
RSP: 002b:00007ffc106948f8 EFLAGS: 00000217 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007ffc10694a10 RCX: 00007f2fbea7eb79
RDX: 0000000000000010 RSI: 0000000020010ff0 RDI: 0000000000000005
RBP: 00000000004004e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000010 R11: 0000000000000217 R12: 0000000000000000
R13: 00007ffc10694a10 R14: 0000000000000000 R15: 0000000000000000
Code: 49 89 f6 49 bc 00 00 00 00 00 fc ff df 48 83 ec 10 48 89 7d c8
48 89 75 d0 e8 d9 fb 46 fd 4c 89 f9 4c 89 fe 48 c1 e9 03 83 e6 07 <42>
0f b6 0c 21 40 38 f1 7f 08 84 c9 0f 85 ef 00 00 00 4c 89 f1
RIP: ax25cmp+0x44/0x160 RSP: ffff880069d15130
---[ end trace 0707d4b9b0f5bb8b ]---
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: disabled
---[ end Kernel panic - not syncing: Fatal exception in interrupt

>
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] SMP KASAN
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Modules linked in:
> CPU: 1 PID: 15 Comm: ksoftirqd/1 Not tainted 4.11.0-rc7+ #251
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> task: ffff88003e10adc0 task.stack: ffff88003e148000
> RIP: 0010:ax25cmp+0x3f/0x150 net/ax25/ax25_addr.c:122
> RSP: 0018:ffff88003e14d450 EFLAGS: 00010202
> RAX: ffff88003e10adc0 RBX: ffff880069c606b8 RCX: 0000000000000002
> RDX: 0000000000000100 RSI: 0000000000000007 RDI: 0000000000000017
> RBP: ffff88003e14d488 R08: dffffc0000000000 R09: 0000000000000000
> R10: 6a8a172cb651d699 R11: dffffc0000000000 R12: dffffc0000000000
> R13: 000000000000001d R14: ffff880069c606c0 R15: 0000000000000017
> FS: 0000000000000000(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000000002044ef69 CR3: 000000005682b000 CR4: 00000000000006e0
> Call Trace:
> rose_route_frame+0x3b1/0x19f0 net/rose/rose_route.c:883
> rose_xmit+0x7f/0x180 net/rose/rose_dev.c:110
> __netdev_start_xmit include/linux/netdevice.h:3980 [inline]
> netdev_start_xmit include/linux/netdevice.h:3989 [inline]
> xmit_one net/core/dev.c:2908 [inline]
> dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:2924
> __dev_queue_xmit+0x1ff8/0x2840 net/core/dev.c:3391
> dev_queue_xmit+0x17/0x20 net/core/dev.c:3424
> bond_dev_queue_xmit+0x185/0x240 drivers/net/bonding/bond_main.c:261
> bond_xmit_slave_id+0x1fe/0x590 drivers/net/bonding/bond_main.c:3702
> bond_xmit_roundrobin drivers/net/bonding/bond_main.c:3779 [inline]
> __bond_start_xmit drivers/net/bonding/bond_main.c:4037 [inline]
> bond_start_xmit+0xb8a/0x17f0 drivers/net/bonding/bond_main.c:4071
> __netdev_start_xmit include/linux/netdevice.h:3980 [inline]
> netdev_start_xmit include/linux/netdevice.h:3989 [inline]
> xmit_one net/core/dev.c:2908 [inline]
> dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:2924
> __dev_queue_xmit+0x1ff8/0x2840 net/core/dev.c:3391
> dev_queue_xmit+0x17/0x20 net/core/dev.c:3424
> neigh_connected_output+0x534/0x790 net/core/neighbour.c:1338
> neigh_output include/net/neighbour.h:478 [inline]
> ip6_finish_output2+0xbf8/0x2560 net/ipv6/ip6_output.c:123
> ip6_finish_output+0x302/0x960 net/ipv6/ip6_output.c:149
> NF_HOOK_COND include/linux/netfilter.h:246 [inline]
> ip6_output+0x1cb/0x8d0 net/ipv6/ip6_output.c:163
> dst_output include/net/dst.h:486 [inline]
> NF_HOOK.constprop.39+0x115/0x650 include/linux/netfilter.h:257
> mld_sendpack+0x6fc/0xd40 net/ipv6/mcast.c:1660
> mld_send_cr net/ipv6/mcast.c:1951 [inline]
> mld_ifc_timer_expire+0x3c3/0x750 net/ipv6/mcast.c:2449
> call_timer_fn+0x23f/0x810 kernel/time/timer.c:1268
> expire_timers kernel/time/timer.c:1307 [inline]
> __run_timers+0x94e/0xcd0 kernel/time/timer.c:1601
> run_timer_softirq+0x21/0x80 kernel/time/timer.c:1614
> __do_softirq+0x2fb/0xb7d kernel/softirq.c:284
> run_ksoftirqd+0x20/0x60 kernel/softirq.c:676
> smpboot_thread_fn+0x562/0x860 kernel/smpboot.c:164
> kthread+0x35e/0x430 kernel/kthread.c:231
> ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430
> Code: 49 89 f6 49 bc 00 00 00 00 00 fc ff df 48 83 ec 10 48 89 7d c8
> 48 89 75 d0 e8 4e 4a 57 fd 4c 89 f9 4c 89 fe 48 c1 e9 03 83 e6 07 <42>
> 0f b6 0c 21 40 38 f1 7f 08 84 c9 0f 85 ef 00 00 00 4c 89 f1
> RIP: ax25cmp+0x3f/0x150 net/ax25/ax25_addr.c:122 RSP: ffff88003e14d450
> ---[ end trace f569731c3e601819 ]---
> Kernel panic - not syncing: Fatal exception in interrupt
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Kernel Offset: disabled
> Rebooting in 86400 seconds..
// autogenerated by syzkaller (http://github.com/google/syzkaller)

#ifndef __NR_connect
#define __NR_connect 42
#endif
#ifndef __NR_ioctl
#define __NR_ioctl 16
#endif
#ifndef __NR_mmap
#define __NR_mmap 9
#endif
#ifndef __NR_socket
#define __NR_socket 41
#endif
#ifndef __NR_setsockopt
#define __NR_setsockopt 54
#endif

#define _GNU_SOURCE

#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>

static void test();

void loop()
{
while (1) {
test();
}
}

long r[23];
void test()
{
memset(r, -1, sizeof(r));
r[0] = syscall(__NR_mmap, 0x20000000ul, 0xff2000ul, 0x3ul, 0x32ul,
0xfffffffffffffffful, 0x0ul);
r[1] = syscall(__NR_socket, 0x2ul, 0x805ul, 0x0ul);
memcpy((void*)0x205ba000,
"\x72\x6f\x73\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00",
16);
r[3] = syscall(__NR_setsockopt, r[1], 0x1ul, 0x19ul, 0x205ba000ul,
0x10ul);
*(uint16_t*)0x20010ff0 = (uint16_t)0x2;
*(uint16_t*)0x20010ff2 = (uint16_t)0x204e;
*(uint8_t*)0x20010ff4 = (uint8_t)0xac;
*(uint8_t*)0x20010ff5 = (uint8_t)0x14;
*(uint8_t*)0x20010ff6 = (uint8_t)0x0;
*(uint8_t*)0x20010ff7 = (uint8_t)0xaa;
*(uint8_t*)0x20010ff8 = (uint8_t)0x0;
*(uint8_t*)0x20010ff9 = (uint8_t)0x0;
*(uint8_t*)0x20010ffa = (uint8_t)0x0;
*(uint8_t*)0x20010ffb = (uint8_t)0x0;
*(uint8_t*)0x20010ffc = (uint8_t)0x0;
*(uint8_t*)0x20010ffd = (uint8_t)0x0;
*(uint8_t*)0x20010ffe = (uint8_t)0x0;
*(uint8_t*)0x20010fff = (uint8_t)0x0;
r[18] = syscall(__NR_connect, r[1], 0x20010ff0ul, 0x10ul);
r[19] = syscall(__NR_socket, 0xaul, 0x6ul, 0x0ul);
memcpy((void*)0x208befe0,
"\x72\x6f\x73\x65\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00",
16);
*(uint16_t*)0x208beff0 = (uint16_t)0x301;
r[22] = syscall(__NR_ioctl, r[19], 0x8914ul, 0x208befe0ul);
}

int main()
{
loop();
return 0;
}

Attachment: .config
Description: Binary data

Next message: Dennis Zhou: "[no subject]"
Previous message: Zi Yan: "Re: [PATCH v7 05/10] mm: thp: enable thp migration in generic path"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]