| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CACT4Y+ZZQ0ooT9LekV35u_jUAtAHJfg5O5SD=xATfHUF5UdNBQ@mail.gmail.com>
Date: Tue, 24 Nov 2015 15:18:22 +0100
From: Dmitry Vyukov <dvyukov@...gle.com>
To: "David S. Miller" <davem@...emloft.net>,
Hannes Frederic Sowa <hannes@...essinduktion.org>,
Eric Dumazet <edumazet@...gle.com>,
Al Viro <viro@...iv.linux.org.uk>,
David Howells <dhowells@...hat.com>,
Ying Xue <ying.xue@...driver.com>,
"Eric W. Biederman" <ebiederm@...ssion.com>,
Rainer Weikusat <rweikusat@...ileactivedefense.com>,
netdev <netdev@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>
Cc: syzkaller <syzkaller@...glegroups.com>,
Kostya Serebryany <kcc@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
Sasha Levin <sasha.levin@...cle.com>
Subject: use-after-free in sock_wake_async
Hello,
The following program triggers use-after-free in sock_wake_async:
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <syscall.h>
#include <string.h>
#include <stdint.h>
#include <pthread.h>
long r2 = -1;
long r3 = -1;
long r7 = -1;
void *thr0(void *arg)
{
syscall(SYS_splice, r2, 0x0ul, r7, 0x0ul, 0x4ul, 0x8ul);
return 0;
}
void *thr1(void *arg)
{
syscall(SYS_close, r2, 0, 0, 0, 0, 0);
return 0;
}
void *thr2(void *arg)
{
syscall(SYS_write, r3, 0x20003000ul, 0xe7ul, 0, 0, 0);
return 0;
}
int main()
{
long r0 = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul);
long r1 = syscall(SYS_socketpair, 0x1ul, 0x1ul, 0x0ul,
0x20000000ul, 0, 0);
r2 = *(uint32_t*)0x20000000;
r3 = *(uint32_t*)0x20000004;
*(uint64_t*)0x20001000 = 0x4;
long r5 = syscall(SYS_ioctl, r2, 0x5452ul, 0x20001000ul, 0, 0, 0);
long r6 = syscall(SYS_pipe2, 0x20002000ul, 0x80800ul, 0, 0, 0, 0);
r7 = *(uint32_t*)0x20002004;
pthread_t th[3];
pthread_create(&th[0], 0, thr0, 0);
pthread_create(&th[1], 0, thr1, 0);
pthread_create(&th[2], 0, thr2, 0);
pthread_join(th[0], 0);
pthread_join(th[1], 0);
pthread_join(th[2], 0);
return 0;
}
The use-after-free fires after a minute of running it in a tight
parallel loop. I use the stress utility for this:
$ go get golang.org/x/tools/cmd/stress
$ stress -p 128 -failure "ignore" ./a.out
==================================================================
BUG: KASAN: use-after-free in sock_wake_async+0x325/0x340 at addr
ffff880061d1ad10
Read of size 8 by task a.out/23178
=============================================================================
BUG sock_inode_cache (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in sock_alloc_inode+0x1d/0x220 age=0 cpu=2 pid=23183
[< none >] kmem_cache_alloc+0x1a6/0x1f0 mm/slub.c:2514
[< none >] sock_alloc_inode+0x1d/0x220 net/socket.c:250
[< none >] alloc_inode+0x61/0x180 fs/inode.c:198
[< none >] new_inode_pseudo+0x17/0xe0 fs/inode.c:878
[< none >] sock_alloc+0x3d/0x260 net/socket.c:540
[< none >] __sock_create+0xa7/0x620 net/socket.c:1133
[< inline >] sock_create net/socket.c:1209
[< inline >] SYSC_socketpair net/socket.c:1281
[< none >] SyS_socketpair+0x112/0x4e0 net/socket.c:1260
[< none >] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
INFO: Freed in sock_destroy_inode+0x56/0x70 age=0 cpu=2 pid=23185
[< none >] kmem_cache_free+0x24e/0x260 mm/slub.c:2742
[< none >] sock_destroy_inode+0x56/0x70 net/socket.c:279
[< none >] destroy_inode+0xc4/0x120 fs/inode.c:255
[< none >] evict+0x36b/0x580 fs/inode.c:559
[< inline >] iput_final fs/inode.c:1477
[< none >] iput+0x4a0/0x790 fs/inode.c:1504
[< inline >] dentry_iput fs/dcache.c:358
[< none >] __dentry_kill+0x4fe/0x700 fs/dcache.c:543
[< inline >] dentry_kill fs/dcache.c:587
[< none >] dput+0x6ab/0x7a0 fs/dcache.c:796
[< none >] __fput+0x3fb/0x6e0 fs/file_table.c:226
[< none >] ____fput+0x15/0x20 fs/file_table.c:244
[< none >] task_work_run+0x163/0x1f0 kernel/task_work.c:115
(discriminator 1)
[< inline >] tracehook_notify_resume include/linux/tracehook.h:191
[< none >] exit_to_usermode_loop+0x180/0x1a0
arch/x86/entry/common.c:251
[< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:282
[< none >] syscall_return_slowpath+0x19f/0x210
arch/x86/entry/common.c:344
[< none >] int_ret_from_sys_call+0x25/0x9f
arch/x86/entry/entry_64.S:281
INFO: Slab 0xffffea0001874600 objects=25 used=2 fp=0xffff880061d1c100
flags=0x500000000004080
INFO: Object 0xffff880061d1ad00 @offset=11520 fp=0xffff880061d1a300
CPU: 3 PID: 23178 Comm: a.out Tainted: G B 4.4.0-rc1+ #84
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
00000000ffffffff ffff880061baf8f0 ffffffff825d3336 ffff88003e0dc280
ffff880061d1ad00 ffff880061d18000 ffff880061baf920 ffffffff81618784
ffff88003e0dc280 ffffea0001874600 ffff880061d1ad00 00000000000000e7
Call Trace:
[<ffffffff8162135e>] __asan_report_load8_noabort+0x3e/0x40
mm/kasan/report.c:280
[< inline >] __read_once_size include/linux/compiler.h:218
[<ffffffff83dcda05>] sock_wake_async+0x325/0x340 net/socket.c:1068
[< inline >] sk_wake_async include/net/sock.h:2011
[<ffffffff83ddb414>] sock_def_readable+0x1e4/0x290 net/core/sock.c:2312
[<ffffffff84188bdb>] unix_stream_sendmsg+0x4db/0x930 net/unix/af_unix.c:1864
[< inline >] sock_sendmsg_nosec net/socket.c:610
[<ffffffff83dcb1fa>] sock_sendmsg+0xca/0x110 net/socket.c:620
[<ffffffff83dcb456>] sock_write_iter+0x216/0x3a0 net/socket.c:819
[< inline >] new_sync_write fs/read_write.c:478
[<ffffffff8165d310>] __vfs_write+0x300/0x470 fs/read_write.c:491
[<ffffffff8165e4fe>] vfs_write+0x16e/0x490 fs/read_write.c:538
[< inline >] SYSC_write fs/read_write.c:585
[<ffffffff81661141>] SyS_write+0x111/0x220 fs/read_write.c:577
[<ffffffff84bf0c36>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
==================================================================
I am on commit 8005c49d9aea74d382f474ce11afbbc7d7130bec (Nov 15) but
also merged in 7d267278a9ece963d77eefec61630223fce08c6c (unix: avoid
use-after-free in ep_remove_wait_queue) from net repo.
Thanks
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists