Re: KASAN: use-after-free Read in tomoyo_socket_sendmsg_permission

[Cong Wang]

On Fri, Aug 9, 2019 at 1:53 AM Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
>
> On Fri, Aug 9, 2019 at 12:08 AM Tetsuo Handa
> <penguin-kernel@xxxxxxxxxxxxxxxxxxx> wrote:
> >
> > On 2019/08/09 1:45, syzbot wrote:
> > > Hello,
> > >
> > > syzbot found the following crash on:
> > >
> > > HEAD commit:    107e47cc vrf: make sure skb->data contains ip header to ma..
> > > git tree:       net
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=139506d8600000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=4dba67bf8b8c9ad7
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=b91501546ab4037f685f
> > > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> >
> > This is not TOMOYO's bug. LSM modules expect that "struct sock" does not go away.
> >
> > Also, another use-after-free (presumably on the same "struct sock") was concurrently
> > inflight at nr_insert_socket() in net/netrom/af_netrom.c . Thus, suspecting netrom's bug.
>
> There is a number of UAFs/refcount bugs in nr sockets lately. Most
> likely it's the same issue them. Most of them were bisected to:
>
> commit c8c8218ec5af5d2598381883acbefbf604e56b5e
> Date: Thu Jun 27 21:30:58 2019 +0000
>   netrom: fix a memory leak in nr_rx_frame()

The UAF introduced by this commit has been fixed. There is
another UAF in netrom which exists long before the above commit,
it is not fixed. The last time I looked at it, it seems related to the
state machine used by netrom sockets, so it is not easy.

Thanks,