netdev - KASAN: use-after-free Read in inet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Wed, 07 Feb 2018 06:27:01 -0800
From:   syzbot <syzbot+347bd5acde002e353a36@...kaller.appspotmail.com>
To:     davem@...emloft.net, jchapman@...alix.com, kuznet@....inr.ac.ru,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com, yoshfuji@...ux-ipv6.org
Subject: KASAN: use-after-free Read in inet_shutdown

Hello,

syzbot has tested the proposed patch but the reproducer still triggered  
crash:
KASAN: use-after-free Read in pppol2tp_put_sk

IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
==================================================================
BUG: KASAN: use-after-free in pppol2tp_put_sk+0xa8/0xb0  
net/l2tp/l2tp_ppp.c:457
Read of size 8 at addr ffff8801c01b6708 by task syz-executor/4295
IPVS: ftp: loaded support on port[0] = 21

CPU: 0 PID: 4295 Comm: syz-executor Not tainted 4.15.0+ #31
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  <IRQ>
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x194/0x257 lib/dump_stack.c:53
IPVS: ftp: loaded support on port[0] = 21
  print_address_description+0x73/0x250 mm/kasan/report.c:252
  kasan_report_error mm/kasan/report.c:351 [inline]
  kasan_report+0x25b/0x340 mm/kasan/report.c:409
  __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
  pppol2tp_put_sk+0xa8/0xb0 net/l2tp/l2tp_ppp.c:457
  __rcu_reclaim kernel/rcu/rcu.h:172 [inline]
  rcu_do_batch kernel/rcu/tree.c:2674 [inline]
  invoke_rcu_callbacks kernel/rcu/tree.c:2933 [inline]
  __rcu_process_callbacks kernel/rcu/tree.c:2900 [inline]
  rcu_process_callbacks+0xd6c/0x17f0 kernel/rcu/tree.c:2917
IPVS: ftp: loaded support on port[0] = 21
  __do_softirq+0x2d7/0xb85 kernel/softirq.c:285
IPVS: ftp: loaded support on port[0] = 21
  invoke_softirq kernel/softirq.c:365 [inline]
  irq_exit+0x1cc/0x200 kernel/softirq.c:405
  exiting_irq arch/x86/include/asm/apic.h:541 [inline]
  smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
IPVS: ftp: loaded support on port[0] = 21
  apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:938
  </IRQ>
RIP: 0033:0x40599b
RSP: 002b:00007fff06a24290 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff11
RAX: 000000000000000d RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 000000000000000d RDI: 000000002076afdb
RBP: 0000000000000001 R08: 0000000000000000 R09: 000000000071bf58
R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000005
R13: fffffffffffffffe R14: 000000000071ca20 R15: ffffffffffffffff

Allocated by task 4296:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:447
  set_track mm/kasan/kasan.c:459 [inline]
  kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
  __do_kmalloc mm/slab.c:3705 [inline]
  __kmalloc+0x162/0x760 mm/slab.c:3714
  kmalloc include/linux/slab.h:517 [inline]
  kzalloc include/linux/slab.h:701 [inline]
  l2tp_session_create+0x100/0xe50 net/l2tp/l2tp_core.c:1738
  pppol2tp_session_prep+0x2fc/0xa40 net/l2tp/l2tp_ppp.c:711
  pppol2tp_connect+0x74a/0x1550 net/l2tp/l2tp_ppp.c:856
  SYSC_connect+0x213/0x4a0 net/socket.c:1639
  SyS_connect+0x24/0x30 net/socket.c:1620
  entry_SYSCALL_64_fastpath+0x29/0xa0

Freed by task 4295:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:447
  set_track mm/kasan/kasan.c:459 [inline]
  kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
  __cache_free mm/slab.c:3485 [inline]
  kfree+0xd6/0x260 mm/slab.c:3800
  pppol2tp_put_sk+0x4c/0xb0 net/l2tp/l2tp_ppp.c:456
  __rcu_reclaim kernel/rcu/rcu.h:172 [inline]
  rcu_do_batch kernel/rcu/tree.c:2674 [inline]
  invoke_rcu_callbacks kernel/rcu/tree.c:2933 [inline]
  __rcu_process_callbacks kernel/rcu/tree.c:2900 [inline]
  rcu_process_callbacks+0xd6c/0x17f0 kernel/rcu/tree.c:2917
  __do_softirq+0x2d7/0xb85 kernel/softirq.c:285

The buggy address belongs to the object at ffff8801c01b6480
  which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 648 bytes inside of
  1024-byte region [ffff8801c01b6480, ffff8801c01b6880)
The buggy address belongs to the page:
page:ffffea0007006d80 count:1 mapcount:0 mapping:ffff8801c01b6000 index:0x0  
compound_mapcount: 0
IPVS: ftp: loaded support on port[0] = 21
flags: 0x2fffc0000008100(slab|head)
raw: 02fffc0000008100 ffff8801c01b6000 0000000000000000 0000000100000007
raw: ffffea0006dab8a0 ffffea0006f87820 ffff8801db000ac0 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8801c01b6600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8801c01b6680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801c01b6700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                       ^
  ffff8801c01b6780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8801c01b6800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on  
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master  
commit
617aebe6a97efa539cc4b8a52adccd89596e6be0 (Sun Feb 4 00:25:42 2018 +0000)
Merge tag 'usercopy-v4.16-rc1' of  
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

compiler: gcc (GCC) 7.1.1 20170620
Patch is attached.
Kernel config is attached.
Raw console output is attached.


View attachment "patch.diff" of type "text/plain" (38601 bytes)

View attachment "raw.log.txt" of type "text/plain" (10754 bytes)

View attachment "config.txt" of type "text/plain" (136942 bytes)