KASAN: use-after-free Read in sctp_outq_select_transport

From: syzbot
Date: Tue Oct 23 2018 - 06:13:09 EST

Next message: Uwe Kleine-König: "Re: [PATCH] ARM: dts: fix imx7d boot spi dma setup error"
Previous message: Herbert Xu: "Crypto Update for 4.20"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello,

syzbot found the following crash on:

HEAD commit: 23469de647c4 Merge git://git.kernel.org/pub/scm/linux/kern..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=13580ce5400000
kernel config: https://syzkaller.appspot.com/x/.config?x=b3f55cb3dfcc6c33
dashboard link: https://syzkaller.appspot.com/bug?extid=56a40ceee5fb35932f4d
compiler: gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+56a40ceee5fb35932f4d@xxxxxxxxxxxxxxxxxxxxxxxxx

==================================================================
BUG: KASAN: use-after-free in sctp_outq_select_transport+0x77e/0x9a0 net/sctp/outqueue.c:840
Read of size 4 at addr ffff8801c5ff2614 by task syz-executor5/8275

CPU: 0 PID: 8275 Comm: syz-executor5 Not tainted 4.19.0-rc8+ #152
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c4/0x2b6 lib/dump_stack.c:113
print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
sctp_outq_select_transport+0x77e/0x9a0 net/sctp/outqueue.c:840
sctp_outq_flush_data net/sctp/outqueue.c:1100 [inline]
sctp_outq_flush+0x14f7/0x34f0 net/sctp/outqueue.c:1209
sctp_outq_uncork+0x6a/0x80 net/sctp/outqueue.c:776
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1820 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
sctp_do_sm+0x608/0x7190 net/sctp/sm_sideeffect.c:1191
sctp_assoc_bh_rcv+0x346/0x670 net/sctp/associola.c:1067
sctp_inq_push+0x280/0x370 net/sctp/inqueue.c:95
sctp_rcv+0x2d93/0x3c00 net/sctp/input.c:268
sctp6_rcv+0x15/0x30 net/sctp/ipv6.c:1061
ip6_input_finish+0x3fc/0x1aa0 net/ipv6/ip6_input.c:383
NF_HOOK include/linux/netfilter.h:289 [inline]
ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:426
dst_input include/net/dst.h:450 [inline]
ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76
NF_HOOK include/linux/netfilter.h:289 [inline]
ipv6_rcv+0x120/0x640 net/ipv6/ip6_input.c:271
__netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913
__netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023
process_backlog+0x218/0x6f0 net/core/dev.c:5829
napi_poll net/core/dev.c:6249 [inline]
net_rx_action+0x7c5/0x1950 net/core/dev.c:6315
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
__do_softirq+0x30c/0xb03 kernel/softirq.c:292
do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1047
</IRQ>
do_softirq.part.13+0x126/0x160 kernel/softirq.c:336
do_softirq kernel/softirq.c:328 [inline]
__local_bh_enable_ip+0x21d/0x260 kernel/softirq.c:189
local_bh_enable include/linux/bottom_half.h:32 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:723 [inline]
ip6_finish_output2+0xce4/0x27a0 net/ipv6/ip6_output.c:121
ip6_finish_output+0x58c/0xc60 net/ipv6/ip6_output.c:154
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip6_output+0x232/0x9d0 net/ipv6/ip6_output.c:171
dst_output include/net/dst.h:444 [inline]
NF_HOOK include/linux/netfilter.h:289 [inline]
ip6_xmit+0xf69/0x2420 net/ipv6/ip6_output.c:275
sctp_v6_xmit+0x3b2/0x790 net/sctp/ipv6.c:230
sctp_packet_transmit+0x298e/0x3db0 net/sctp/output.c:656
sctp_packet_singleton net/sctp/outqueue.c:791 [inline]
sctp_outq_flush_ctrl.constprop.11+0x7a9/0xe50 net/sctp/outqueue.c:922
sctp_outq_flush+0x310/0x34f0 net/sctp/outqueue.c:1204
sctp_outq_uncork+0x6a/0x80 net/sctp/outqueue.c:776
kobject: 'rfkill9' (0000000067be229d): fill_kobj_path: path = '/devices/virtual/mac80211_hwsim/hwsim7/ieee80211/phy7/rfkill9'
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1349 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
sctp_do_sm+0x4f25/0x7190 net/sctp/sm_sideeffect.c:1191
ieee80211 phy7: Selected rate control algorithm 'minstrel_ht'
kobject: 'net' (00000000cdd117dc): kobject_add_internal: parent: 'hwsim7', set: '(null)'
sctp_endpoint_bh_rcv+0x465/0x960 net/sctp/endpointola.c:456
kobject: 'wlan0' (00000000c9d333fc): kobject_add_internal: parent: 'net', set: 'devices'
sctp_inq_push+0x280/0x370 net/sctp/inqueue.c:95
sctp_backlog_rcv+0x1a8/0xd50 net/sctp/input.c:351
kobject: 'wlan0' (00000000c9d333fc): kobject_uevent_env
kobject: 'wlan0' (00000000c9d333fc): fill_kobj_path: path = '/devices/virtual/mac80211_hwsim/hwsim7/net/wlan0'
sk_backlog_rcv include/net/sock.h:931 [inline]
__release_sock+0x12f/0x3a0 net/core/sock.c:2336
kobject: 'queues' (00000000c5d009e9): kobject_add_internal: parent: 'wlan0', set: '<NULL>'
release_sock+0xad/0x2c0 net/core/sock.c:2849
sock_setsockopt+0x60d/0x2280 net/core/sock.c:1054
kobject: 'queues' (00000000c5d009e9): kobject_uevent_env
kobject: 'queues' (00000000c5d009e9): kobject_uevent_env: filter function caused the event to drop!
__sys_setsockopt+0x304/0x3c0 net/socket.c:1898
kobject: 'rx-0' (000000007736ba36): kobject_add_internal: parent: 'queues', set: 'queues'
__do_sys_setsockopt net/socket.c:1913 [inline]
__se_sys_setsockopt net/socket.c:1910 [inline]
__x64_sys_setsockopt+0xbe/0x150 net/socket.c:1910
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
kobject: 'rx-0' (000000007736ba36): kobject_uevent_env
entry_SYSCALL_64_after_hwframe+0x49/0xbe
kobject: 'rx-0' (000000007736ba36): fill_kobj_path: path = '/devices/virtual/mac80211_hwsim/hwsim7/net/wlan0/queues/rx-0'
RIP: 0033:0x457569
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f0613beec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457569
RDX: 000000000000001a RSI: 0000000000000001 RDI: 0000000000000003
RBP: 000000000072c040 R08: 0000000000000010 R09: 0000000000000000
R10: 00000000200000c0 R11: 0000000000000246 R12: 00007f0613bef6d4
R13: 00000000004c3b61 R14: 00000000004d5c88 R15: 00000000ffffffff

Allocated by task 8261:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
kobject: 'tx-0' (000000008f0eae4c): kobject_add_internal: parent: 'queues', set: 'queues'
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
kmem_cache_alloc_trace+0x152/0x750 mm/slab.c:3620
kmalloc include/linux/slab.h:513 [inline]
kzalloc include/linux/slab.h:707 [inline]
sctp_transport_new+0x10a/0x880 net/sctp/transport.c:111
sctp_assoc_add_peer+0x2de/0x10d0 net/sctp/associola.c:630
sctp_process_param net/sctp/sm_make_chunk.c:2540 [inline]
sctp_process_init+0xfc0/0x29e0 net/sctp/sm_make_chunk.c:2356
sctp_cmd_process_init net/sctp/sm_sideeffect.c:682 [inline]
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1410 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
sctp_do_sm+0x13b9/0x7190 net/sctp/sm_sideeffect.c:1191
sctp_assoc_bh_rcv+0x346/0x670 net/sctp/associola.c:1067
sctp_inq_push+0x280/0x370 net/sctp/inqueue.c:95
sctp_backlog_rcv+0x1a8/0xd50 net/sctp/input.c:351
sk_backlog_rcv include/net/sock.h:931 [inline]
__release_sock+0x12f/0x3a0 net/core/sock.c:2336
kobject: 'tx-0' (000000008f0eae4c): kobject_uevent_env
release_sock+0xad/0x2c0 net/core/sock.c:2849
sctp_wait_for_connect+0x391/0x640 net/sctp/socket.c:8667
sctp_sendmsg_to_asoc+0x1d0f/0x2230 net/sctp/socket.c:1985
sctp_sendmsg+0x13c2/0x1da0 net/sctp/socket.c:2131
inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
sock_sendmsg_nosec net/socket.c:621 [inline]
sock_sendmsg+0xd5/0x120 net/socket.c:631
__sys_sendto+0x3d7/0x670 net/socket.c:1788
__do_sys_sendto net/socket.c:1800 [inline]
__se_sys_sendto net/socket.c:1796 [inline]
__x64_sys_sendto+0xe1/0x1a0 net/socket.c:1796
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
kobject: 'tx-0' (000000008f0eae4c): fill_kobj_path: path = '/devices/virtual/mac80211_hwsim/hwsim7/net/wlan0/queues/tx-0'

Freed by task 9:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kfree+0xcf/0x230 mm/slab.c:3813
sctp_transport_destroy_rcu+0x4a/0x60 net/sctp/transport.c:163
__rcu_reclaim kernel/rcu/rcu.h:236 [inline]
rcu_do_batch kernel/rcu/tree.c:2576 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2880 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2847 [inline]
rcu_process_callbacks+0xf23/0x2670 kernel/rcu/tree.c:2864
__do_softirq+0x30c/0xb03 kernel/softirq.c:292
kobject: 'tx-1' (000000009aaee194): kobject_add_internal: parent: 'queues', set: 'queues'

The buggy address belongs to the object at ffff8801c5ff24c0
which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 340 bytes inside of
1024-byte region [ffff8801c5ff24c0, ffff8801c5ff28c0)
The buggy address belongs to the page:
page:ffffea000717fc80 count:1 mapcount:0 mapping:ffff8801da800ac0 index:0x0 compound_mapcount: 0
flags: 0x2fffc0000008100(slab|head)
raw: 02fffc0000008100 ffffea00070ed808 ffffea00071b2488 ffff8801da800ac0
raw: 0000000000000000 ffff8801c5ff2040 0000000100000007 0000000000000000
kobject: 'tx-1' (000000009aaee194): kobject_uevent_env
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8801c5ff2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801c5ff2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

ffff8801c5ff2600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

^
ffff8801c5ff2680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801c5ff2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxxx

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot.

Next message: Uwe Kleine-König: "Re: [PATCH] ARM: dts: fix imx7d boot spi dma setup error"
Previous message: Herbert Xu: "Crypto Update for 4.20"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]