Re: KASAN: use-after-free Read in sctp_outq_select_transport

From: Xin Long
Date: Sat Oct 27 2018 - 03:34:01 EST

Next message: Christoph Hellwig: "Re: [PATCH 1/2] Move EM_RISCV into elf-em.h"
Previous message: Al Viro: "Re: The linux devs can rescind their license grant."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Tue, Oct 23, 2018 at 7:14 PM syzbot
<syzbot+56a40ceee5fb35932f4d@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 23469de647c4 Merge git://git.kernel.org/pub/scm/linux/kern..
> git tree: net
> console output: https://syzkaller.appspot.com/x/log.txt?x=13580ce5400000
> kernel config: https://syzkaller.appspot.com/x/.config?x=b3f55cb3dfcc6c33
> dashboard link: https://syzkaller.appspot.com/bug?extid=56a40ceee5fb35932f4d
> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+56a40ceee5fb35932f4d@xxxxxxxxxxxxxxxxxxxxxxxxx
>
> ==================================================================
> BUG: KASAN: use-after-free in sctp_outq_select_transport+0x77e/0x9a0
> net/sctp/outqueue.c:840
> Read of size 4 at addr ffff8801c5ff2614 by task syz-executor5/8275
>
> CPU: 0 PID: 8275 Comm: syz-executor5 Not tainted 4.19.0-rc8+ #152
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
> <IRQ>
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x1c4/0x2b6 lib/dump_stack.c:113
> print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
> kasan_report_error mm/kasan/report.c:354 [inline]
> kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
> __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
> sctp_outq_select_transport+0x77e/0x9a0 net/sctp/outqueue.c:840
I think we need a fix like:
@@ -586,6 +586,10 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
sctp_transport_hold(active);
}

+ list_for_each_entry(ch, &asoc->outqueue.out_chunk_list, list)
+ if (ch->transport == transport)
+ ch->transport = NULL;
+
asoc->peer.transport_count--;

sctp_transport_free(peer);

> sctp_outq_flush_data net/sctp/outqueue.c:1100 [inline]
> sctp_outq_flush+0x14f7/0x34f0 net/sctp/outqueue.c:1209
> sctp_outq_uncork+0x6a/0x80 net/sctp/outqueue.c:776
> sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1820 [inline]
> sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
> sctp_do_sm+0x608/0x7190 net/sctp/sm_sideeffect.c:1191
> sctp_assoc_bh_rcv+0x346/0x670 net/sctp/associola.c:1067
> sctp_inq_push+0x280/0x370 net/sctp/inqueue.c:95
> sctp_rcv+0x2d93/0x3c00 net/sctp/input.c:268
> sctp6_rcv+0x15/0x30 net/sctp/ipv6.c:1061
> ip6_input_finish+0x3fc/0x1aa0 net/ipv6/ip6_input.c:383
> NF_HOOK include/linux/netfilter.h:289 [inline]
> ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:426
> dst_input include/net/dst.h:450 [inline]
> ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76
> NF_HOOK include/linux/netfilter.h:289 [inline]
> ipv6_rcv+0x120/0x640 net/ipv6/ip6_input.c:271
> __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913
> __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023
> process_backlog+0x218/0x6f0 net/core/dev.c:5829
> napi_poll net/core/dev.c:6249 [inline]
> net_rx_action+0x7c5/0x1950 net/core/dev.c:6315
> IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
> IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
> __do_softirq+0x30c/0xb03 kernel/softirq.c:292
> do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1047
> </IRQ>
> do_softirq.part.13+0x126/0x160 kernel/softirq.c:336
> do_softirq kernel/softirq.c:328 [inline]
> __local_bh_enable_ip+0x21d/0x260 kernel/softirq.c:189
> local_bh_enable include/linux/bottom_half.h:32 [inline]
> rcu_read_unlock_bh include/linux/rcupdate.h:723 [inline]
> ip6_finish_output2+0xce4/0x27a0 net/ipv6/ip6_output.c:121
> ip6_finish_output+0x58c/0xc60 net/ipv6/ip6_output.c:154
> NF_HOOK_COND include/linux/netfilter.h:278 [inline]
> ip6_output+0x232/0x9d0 net/ipv6/ip6_output.c:171
> dst_output include/net/dst.h:444 [inline]
> NF_HOOK include/linux/netfilter.h:289 [inline]
> ip6_xmit+0xf69/0x2420 net/ipv6/ip6_output.c:275
> sctp_v6_xmit+0x3b2/0x790 net/sctp/ipv6.c:230
> sctp_packet_transmit+0x298e/0x3db0 net/sctp/output.c:656
> sctp_packet_singleton net/sctp/outqueue.c:791 [inline]
> sctp_outq_flush_ctrl.constprop.11+0x7a9/0xe50 net/sctp/outqueue.c:922
> sctp_outq_flush+0x310/0x34f0 net/sctp/outqueue.c:1204
> sctp_outq_uncork+0x6a/0x80 net/sctp/outqueue.c:776
> kobject: 'rfkill9' (0000000067be229d): fill_kobj_path: path
> = '/devices/virtual/mac80211_hwsim/hwsim7/ieee80211/phy7/rfkill9'
> sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1349 [inline]
> sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
> sctp_do_sm+0x4f25/0x7190 net/sctp/sm_sideeffect.c:1191
> ieee80211 phy7: Selected rate control algorithm 'minstrel_ht'
> kobject: 'net' (00000000cdd117dc): kobject_add_internal: parent: 'hwsim7',
> set: '(null)'
> sctp_endpoint_bh_rcv+0x465/0x960 net/sctp/endpointola.c:456
> kobject: 'wlan0' (00000000c9d333fc): kobject_add_internal: parent: 'net',
> set: 'devices'
> sctp_inq_push+0x280/0x370 net/sctp/inqueue.c:95
> sctp_backlog_rcv+0x1a8/0xd50 net/sctp/input.c:351
> kobject: 'wlan0' (00000000c9d333fc): kobject_uevent_env
> kobject: 'wlan0' (00000000c9d333fc): fill_kobj_path: path
> = '/devices/virtual/mac80211_hwsim/hwsim7/net/wlan0'
> sk_backlog_rcv include/net/sock.h:931 [inline]
> __release_sock+0x12f/0x3a0 net/core/sock.c:2336
> kobject: 'queues' (00000000c5d009e9): kobject_add_internal:
> parent: 'wlan0', set: '<NULL>'
> release_sock+0xad/0x2c0 net/core/sock.c:2849
> sock_setsockopt+0x60d/0x2280 net/core/sock.c:1054
> kobject: 'queues' (00000000c5d009e9): kobject_uevent_env
> kobject: 'queues' (00000000c5d009e9): kobject_uevent_env: filter function
> caused the event to drop!
> __sys_setsockopt+0x304/0x3c0 net/socket.c:1898
> kobject: 'rx-0' (000000007736ba36): kobject_add_internal: parent: 'queues',
> set: 'queues'
> __do_sys_setsockopt net/socket.c:1913 [inline]
> __se_sys_setsockopt net/socket.c:1910 [inline]
> __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1910
> do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
> kobject: 'rx-0' (000000007736ba36): kobject_uevent_env
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> kobject: 'rx-0' (000000007736ba36): fill_kobj_path: path
> = '/devices/virtual/mac80211_hwsim/hwsim7/net/wlan0/queues/rx-0'
> RIP: 0033:0x457569
> Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
> 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
> ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
> RSP: 002b:00007f0613beec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
> RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457569
> RDX: 000000000000001a RSI: 0000000000000001 RDI: 0000000000000003
> RBP: 000000000072c040 R08: 0000000000000010 R09: 0000000000000000
> R10: 00000000200000c0 R11: 0000000000000246 R12: 00007f0613bef6d4
> R13: 00000000004c3b61 R14: 00000000004d5c88 R15: 00000000ffffffff
>
> Allocated by task 8261:
> save_stack+0x43/0xd0 mm/kasan/kasan.c:448
> kobject: 'tx-0' (000000008f0eae4c): kobject_add_internal: parent: 'queues',
> set: 'queues'
> set_track mm/kasan/kasan.c:460 [inline]
> kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
> kmem_cache_alloc_trace+0x152/0x750 mm/slab.c:3620
> kmalloc include/linux/slab.h:513 [inline]
> kzalloc include/linux/slab.h:707 [inline]
> sctp_transport_new+0x10a/0x880 net/sctp/transport.c:111
> sctp_assoc_add_peer+0x2de/0x10d0 net/sctp/associola.c:630
> sctp_process_param net/sctp/sm_make_chunk.c:2540 [inline]
> sctp_process_init+0xfc0/0x29e0 net/sctp/sm_make_chunk.c:2356
> sctp_cmd_process_init net/sctp/sm_sideeffect.c:682 [inline]
> sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1410 [inline]
> sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
> sctp_do_sm+0x13b9/0x7190 net/sctp/sm_sideeffect.c:1191
> sctp_assoc_bh_rcv+0x346/0x670 net/sctp/associola.c:1067
> sctp_inq_push+0x280/0x370 net/sctp/inqueue.c:95
> sctp_backlog_rcv+0x1a8/0xd50 net/sctp/input.c:351
> sk_backlog_rcv include/net/sock.h:931 [inline]
> __release_sock+0x12f/0x3a0 net/core/sock.c:2336
> kobject: 'tx-0' (000000008f0eae4c): kobject_uevent_env
> release_sock+0xad/0x2c0 net/core/sock.c:2849
> sctp_wait_for_connect+0x391/0x640 net/sctp/socket.c:8667
> sctp_sendmsg_to_asoc+0x1d0f/0x2230 net/sctp/socket.c:1985
> sctp_sendmsg+0x13c2/0x1da0 net/sctp/socket.c:2131
> inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
> sock_sendmsg_nosec net/socket.c:621 [inline]
> sock_sendmsg+0xd5/0x120 net/socket.c:631
> __sys_sendto+0x3d7/0x670 net/socket.c:1788
> __do_sys_sendto net/socket.c:1800 [inline]
> __se_sys_sendto net/socket.c:1796 [inline]
> __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1796
> do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
> kobject: 'tx-0' (000000008f0eae4c): fill_kobj_path: path
> = '/devices/virtual/mac80211_hwsim/hwsim7/net/wlan0/queues/tx-0'
>
> Freed by task 9:
> save_stack+0x43/0xd0 mm/kasan/kasan.c:448
> set_track mm/kasan/kasan.c:460 [inline]
> __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
> kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
> __cache_free mm/slab.c:3498 [inline]
> kfree+0xcf/0x230 mm/slab.c:3813
> sctp_transport_destroy_rcu+0x4a/0x60 net/sctp/transport.c:163
> __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
> rcu_do_batch kernel/rcu/tree.c:2576 [inline]
> invoke_rcu_callbacks kernel/rcu/tree.c:2880 [inline]
> __rcu_process_callbacks kernel/rcu/tree.c:2847 [inline]
> rcu_process_callbacks+0xf23/0x2670 kernel/rcu/tree.c:2864
> __do_softirq+0x30c/0xb03 kernel/softirq.c:292
> kobject: 'tx-1' (000000009aaee194): kobject_add_internal: parent: 'queues',
> set: 'queues'
>
> The buggy address belongs to the object at ffff8801c5ff24c0
> which belongs to the cache kmalloc-1024 of size 1024
> The buggy address is located 340 bytes inside of
> 1024-byte region [ffff8801c5ff24c0, ffff8801c5ff28c0)
> The buggy address belongs to the page:
> page:ffffea000717fc80 count:1 mapcount:0 mapping:ffff8801da800ac0 index:0x0
> compound_mapcount: 0
> flags: 0x2fffc0000008100(slab|head)
> raw: 02fffc0000008100 ffffea00070ed808 ffffea00071b2488 ffff8801da800ac0
> raw: 0000000000000000 ffff8801c5ff2040 0000000100000007 0000000000000000
> kobject: 'tx-1' (000000009aaee194): kobject_uevent_env
> page dumped because: kasan: bad access detected
>
> Memory state around the buggy address:
> ffff8801c5ff2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801c5ff2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ffff8801c5ff2600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ^
> ffff8801c5ff2680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801c5ff2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ==================================================================
>
>
> ---
> This bug is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxxx
>
> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
> syzbot.

Next message: Christoph Hellwig: "Re: [PATCH 1/2] Move EM_RISCV into elf-em.h"
Previous message: Al Viro: "Re: The linux devs can rescind their license grant."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]