lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 29 Jan 2017 08:40:02 -0200
From:   Marcelo Ricardo Leitner <>
To:     Alexander Popov <>
Cc:     Vlad Yasevich <>,
        Neil Horman <>,
        "David S. Miller" <>,,,,
        syzkaller <>
Subject: Re: BUG at net/sctp/socket.c:7425

On Sun, Jan 29, 2017 at 03:35:31AM +0300, Alexander Popov wrote:
> Hello,
> I'm running the syzkaller fuzzer for v4.10-rc4 (0aa0313f9d576affd7747cc3f179feb097d28990)
> and have such a crash in sctp code:
> Unfortunately, I didn't manage to get a C program reproducing the crash (looks like race).
> However, I stably hit it on my setup - so I can help fixing the issue.
> The crash happens here:
> 	/* Let another process have a go.  Since we are going
> 	 * to sleep anyway.
> 	 */
> 	release_sock(sk);
> 	current_timeo = schedule_timeout(current_timeo);
> >	BUG_ON(sk != asoc->;
> 	lock_sock(sk);
> I've added some debugging output and see, that the original value of asoc-> is
> changed to the address of another struct sock, which appeared in sctp_endpoint_init()
> shortly before the crash.

You need some threading for this to happen.  asoc-> will change
if you peeloff the association.
It seems you had one thread waiting for some sndbuf to be available on a
sendmsg() call and another thread did a peeloff on the association that
the first thread was using.
Yeah I think this will reproduce it.
And in this case, it's probably better if we just return -EPIPE as the
association doesn't exist in that socket anymore instead of the BUG_ON.



diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 26a514269b92..e9870aead88b 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6838,7 +6838,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
 		current_timeo = schedule_timeout(current_timeo);
-		BUG_ON(sk != asoc->;
+		if (sk != asoc->
+			goto do_error;
 		*timeo_p = current_timeo;

Powered by blists - more mailing lists