| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CACT4Y+b3NGvuhYhqRquHk+MiUH+0yPCuSq4EDkvCa5Ov2Jpr6g@mail.gmail.com>
Date: Thu, 26 Nov 2015 14:09:48 +0100
From: Dmitry Vyukov <dvyukov@...gle.com>
To: Peter Hurley <peter@...leysoftware.com>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Jiri Slaby <jslaby@...e.com>,
LKML <linux-kernel@...r.kernel.org>,
syzkaller <syzkaller@...glegroups.com>,
Kostya Serebryany <kcc@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
Sasha Levin <sasha.levin@...cle.com>,
Eric Dumazet <edumazet@...gle.com>
Subject: Re: use-after-free in tty_check_change
On Thu, Nov 26, 2015 at 2:00 PM, Peter Hurley <peter@...leysoftware.com> wrote:
> Hi Dmitry,
>
> On 11/26/2015 05:31 AM, Dmitry Vyukov wrote:
>> Hello,
>>
>> The following program causes a use-after-free in tty_check_change:
>>
>> // autogenerated by syzkaller (http://github.com/google/syzkaller)
>> #include <sys/types.h>
>> #include <sys/stat.h>
>> #include <fcntl.h>
>> #include <sys/ioctl.h>
>>
>> void *thr(void *arg)
>> {
>> int x = 0;
>> ioctl((int)(long)arg, TIOCGETD, &x);
>> return 0;
>> }
>>
>> void tty()
>> {
>> int fd = open("/dev/ptmx", O_RDONLY|O_SYNC);
>> pthread_t th;
>> pthread_create(&th, 0, thr, (void*)(long)fd);
>> int x = 16;
>> ioctl(fd, TIOCSETD, &x);
>> pthread_join(th, 0);
>> }
>>
>> int main()
>> {
>> int i;
>>
>> for (i = 0; i < 10; i++) {
>> if (fork() == 0) {
>> tty();
>> return 0;
>> }
>> }
>> return 0;
>> }
>>
>>
>> ==================================================================
>> BUG: KASAN: use-after-free in tty_ioctl+0x1f06/0x2140 at addr ffff880061aa0968
>> Read of size 8 by task a.out/6241
>> =============================================================================
>> BUG kmalloc-16 (Not tainted): kasan: bad access detected
>> -----------------------------------------------------------------------------
>
> Thanks for the report. I think I have the patch that fixes this in
> my out-queue as part of a larger patchset.
>
> However, the stack backtrace below and the reported eip don't correspond
> to the what I think the problem is:
>
>
>> BUG: KASAN: use-after-free in tty_ioctl+0x1f06/0x2140 at addr ffff880061aa0968
> ^^^^^^^^^^^^^^
> this offset is off the end of compilation unit for me with gcc 4.8.4
>
> Could you generate a mixed listing file of drivers/tty/tty_io.c and attach
> it please?
The source is plain 6ffeba9607343f15303a399bc402a538800d89d9, but I
use CONFIG_KASAN=y, CONFIG_KASAN_INLINE=y and gcc version 6.0.0
20151014. KASAN does affect generated code significantly.
Line numbers in the report should be correct.
> Regards,
> Peter Hurley
>
>> Disabling lock debugging due to kernel taint
>> INFO: Allocated in tty_ldisc_get.part.3+0x66/0x140 age=6 cpu=3 pid=6230
>> [< none >] kmem_cache_alloc_trace+0x1cf/0x220 mm/slub.c:2589
>> [< none >] tty_ldisc_get.part.3+0x66/0x140 drivers/tty/tty_ldisc.c:172
>> [< none >] tty_set_ldisc+0x83d/0xa70 drivers/tty/tty_ldisc.c:574
>> [< none >] tty_ioctl+0xb2a/0x2140 drivers/tty/tty_io.c:2865
>> [< inline >] spin_unlock include/linux/spinlock.h:347
>> [< inline >] ioctl_fionbio fs/ioctl.c:492
>> [< none >] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:572
>> [< none >] SyS_ioctl+0x8f/0xc0 fs/readdir.c:25
>> [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>>
>> INFO: Freed in tty_set_ldisc+0x4c2/0xa70 age=12 cpu=3 pid=6230
>> [< none >] kfree+0x199/0x1b0 mm/slub.c:3632
>> [< inline >] tty_ldisc_restore drivers/tty/tty_ldisc.c:493
>> [< none >] tty_set_ldisc+0x4c2/0xa70 drivers/tty/tty_ldisc.c:571
>> [< none >] tty_ioctl+0xb2a/0x2140 drivers/tty/tty_io.c:2865
>> [< inline >] spin_unlock include/linux/spinlock.h:347
>> [< inline >] ioctl_fionbio fs/ioctl.c:492
>> [< none >] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:572
>> [< none >] SyS_ioctl+0x8f/0xc0 fs/readdir.c:25
>> [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>>
>> INFO: Slab 0xffffea000186a800 objects=23 used=19 fp=0xffff880061aa12d0
>> flags=0x5fffc0000004080
>> INFO: Object 0xffff880061aa0968 @offset=2408 fp=0xffff880061aa0810
>> CPU: 2 PID: 6241 Comm: a.out Tainted: G B 4.4.0-rc1+ #117
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>> 00000000ffffffff ffff88006db0fab8 ffffffff827450f6 ffff88003e807980
>> ffff880061aa0968 ffff880061aa0000 ffff88006db0fae8 ffffffff81629404
>> ffff88003e807980 ffffea000186a800 ffff880061aa0968 000000000000001b
>>
>> Call Trace:
>> [<ffffffff81631fde>] __asan_report_load8_noabort+0x3e/0x40
>> mm/kasan/report.c:280
>> [< inline >] tty_check_change drivers/tty/tty_io.c:399
>> [<ffffffff82a7b0a6>] tty_ioctl+0x1f06/0x2140 drivers/tty/tty_io.c:2831
>> [< inline >] spin_unlock include/linux/spinlock.h:347
>> [< inline >] ioctl_fionbio fs/ioctl.c:492
>> [<ffffffff816aea91>] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:572
>> [<ffffffff816af2df>] SyS_ioctl+0x8f/0xc0 fs/readdir.c:25
>> [<ffffffff85415cf6>] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>> ==================================================================
>>
>>
>> On commit 6ffeba9607343f15303a399bc402a538800d89d9 (Nov 24).
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists