netdev - Re: use-after-free in sctp_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 3 Dec 2015 11:05:25 -0200
From:	Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
To:	Dmitry Vyukov <dvyukov@...gle.com>
Cc:	vyasevich@...il.com, linux-sctp@...r.kernel.org,
	netdev <netdev@...r.kernel.org>,
	syzkaller <syzkaller@...glegroups.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>,
	Eric Dumazet <edumazet@...gle.com>
Subject: Re: use-after-free in sctp_do_sm

Hi,

On Tue, Nov 24, 2015 at 10:15:57AM +0100, Dmitry Vyukov wrote:
> 
> Call Trace:
>  [<ffffffff8162131e>] __asan_report_load4_noabort+0x3e/0x40
>  [<ffffffff8475ac76>] sctp_do_sm+0x42f6/0x4f60
>  [<ffffffff847b50e9>] sctp_primitive_SHUTDOWN+0xa9/0xd0
>  [<ffffffff847a1426>] sctp_close+0x616/0x790
>  [<ffffffff8409bb0d>] inet_release+0xed/0x1c0 ./net/ipv4/af_inet.c:471
>  [<ffffffff84192cc0>] inet6_release+0x50/0x70 ./net/ipv6/af_inet6.c:416
>  [<     inline     >] constant_test_bit ././arch/x86/include/asm/bitops.h:321
>  [<ffffffff83dc78cd>] sock_release+0x8d/0x200 ./net/socket.c:601
>  [<ffffffff83dc7a56>] sock_close+0x16/0x20 ./net/socket.c:1188
>  [<ffffffff81662f5d>] __fput+0x21d/0x6e0 ./fs/file_table.c:265
>  [<ffffffff816634a5>] ____fput+0x15/0x20 ./fs/file_table.c:84
>  [<ffffffff812a33d3>] task_work_run+0x163/0x1f0 ./include/trace/events/rcu.h:20
>  [<     inline     >] __list_add ./include/linux/list.h:42

By any chance, did you have the pr_debug()s enabled?
Because that would trigger a use-after-free on debug_post_sfx()
macro expansion when the asoc is freed:

#define debug_post_sfx() \                                                
        pr_debug("%s[post-sfx]: error:%d, asoc:%p[%s]\n", __func__, error, \
                 asoc, sctp_state_tbl[(asoc && sctp_id2assoc(ep->base.sk, \
                 sctp_assoc2id(asoc))) ? asoc->state : SCTP_STATE_CLOSED])

  Marcelo

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html