netdev - kernel BUG at net/ipv4/tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 13 Jun 2017 19:39:00 +0800
From:   Dison River <pwn2river@...il.com>
To:     davem@...emloft.net, kuznet@....inr.ac.ru, jmorris@...ei.org,
        yoshfuji@...ux-ipv6.org, kaber@...sh.net, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, security@...nel.org
Subject: kernel BUG at net/ipv4/tcp_output.c:2748!

Hi
   I've got the following error report while fuzzing the kernel with
syzkaller on
linux-4.11.0-rc3.
I provide attachment that contains PoC and PoC source code.
PoC can trigger this bug.
config_4_11_rc3 is config file.
Here is panic log:

------------[ cut here ]------------
kernel BUG at net/ipv4/tcp_output.c:2748!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 15 Comm: ksoftirqd/1 Not tainted 4.11.0-rc3 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
task: ffff88003e17adc0 task.stack: ffff88003e1a8000
RIP: 0010:__tcp_retransmit_skb+0x1945/0x1d40 net/ipv4/tcp_output.c:2748
RSP: 0018:ffff88003e1af9e8 EFLAGS: 00010206
RAX: ffff88003e17adc0 RBX: ffff88003a321568 RCX: 0000000014eed6cd
RDX: 0000000000000100 RSI: ffff88003a321540 RDI: ffff88003a32156c
RBP: ffff88003e1afa80 R08: 00000000a35ea9d4 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88003e17adc0 R12: ffff88003a3215c6
R13: 0000000014eedffd R14: ffff88003a321540 R15: ffff880039640bc0
FS:  0000000000000000(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006e38a0 CR3: 000000003b7b3000 CR4: 00000000000006e0
Call Trace:
 tcp_retransmit_skb+0x2e/0x230 net/ipv4/tcp_output.c:2822
 tcp_retransmit_timer+0xc49/0x23b0 net/ipv4/tcp_timer.c:492
 tcp_write_timer_handler+0x203/0x7a0 net/ipv4/tcp_timer.c:576
 tcp_write_timer+0x179/0x190 net/ipv4/tcp_timer.c:594
 call_timer_fn+0x15b/0x5e0 kernel/time/timer.c:1268
 expire_timers kernel/time/timer.c:1307 [inline]
 __run_timers kernel/time/timer.c:1601 [inline]
 run_timer_softirq+0x5c7/0x1140 kernel/time/timer.c:1614
 __do_softirq+0x217/0x8b7 kernel/softirq.c:284
 run_ksoftirqd+0x1a/0x50 kernel/softirq.c:676
 smpboot_thread_fn+0x420/0x880 kernel/smpboot.c:164
 kthread+0x2e2/0x3f0 kernel/kthread.c:229
 ret_from_fork+0x2e/0x40 arch/x86/entry/entry_64.S:430
Code: 42 7f fe be 00 00 10 00 4c 89 ff e8 96 81 dd ff e9 31 fa ff ff
e8 2c 42 7f fe 4d 89 b7 50 09 00 00 e9 e3 f5 ff ff e8 1b 42 7f fe <0f>
0b e8 34 1a 9e fe e9 c5 f5 ff ff e8 fa 19 9e fe 8b 4d c4 e9
RIP: __tcp_retransmit_skb+0x1945/0x1d40 net/ipv4/tcp_output.c:2748
RSP: ffff88003e1af9e8
---[ end trace 3957062d6d66daab ]---
Kernel panic - not syncing: Fatal exception in interrupt
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

View attachment "poc_tcp_output.c" of type "text/x-csrc" (29566 bytes)

Download attachment "poc_bug" of type "application/octet-stream" (1363752 bytes)

Download attachment "congfig_4_11_rc3" of type "application/octet-stream" (112366 bytes)