| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 20 Feb 2017 13:51:37 +0100
From: Andrey Konovalov <andreyknvl@...gle.com>
To: "David S. Miller" <davem@...emloft.net>,
Alexey Kuznetsov <kuznet@....inr.ac.ru>,
James Morris <jmorris@...ei.org>,
Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
Patrick McHardy <kaber@...sh.net>,
netdev <netdev@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>
Cc: Dmitry Vyukov <dvyukov@...gle.com>,
Kostya Serebryany <kcc@...gle.com>,
Eric Dumazet <edumazet@...gle.com>,
syzkaller <syzkaller@...glegroups.com>
Subject: net/udp: slab-out-of-bounds in udp_recvmsg/do_csum
Hi,
I've got the following error report while fuzzing the kernel with syzkaller.
On commit c470abd4fde40ea6a0846a2beab642a578c0b8cd (4.10).
A reproducer and .config are attached.
BUG: KASAN: slab-out-of-bounds in do_csum+0x333/0x360
arch/x86/lib/csum-partial_64.c:102 at addr ffff880053c47100
Read of size 4 by task syz-executor2/7429
CPU: 2 PID: 7429 Comm: syz-executor2 Not tainted 4.10.0-rc8+ #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0x292/0x398 lib/dump_stack.c:51
kasan_object_err+0x1c/0x70 mm/kasan/report.c:162
print_address_description mm/kasan/report.c:200 [inline]
kasan_report_error mm/kasan/report.c:289 [inline]
kasan_report.part.1+0x20e/0x4e0 mm/kasan/report.c:311
kasan_report mm/kasan/report.c:331 [inline]
__asan_report_load4_noabort+0x29/0x30 mm/kasan/report.c:331
do_csum+0x333/0x360 arch/x86/lib/csum-partial_64.c:102
csum_partial+0x21/0x30 arch/x86/lib/csum-partial_64.c:135
ip_cmsg_recv_checksum net/ipv4/ip_sockglue.c:120 [inline]
ip_cmsg_recv_offset+0xf57/0x1240 net/ipv4/ip_sockglue.c:231
udp_recvmsg+0xf86/0x1380 net/ipv4/udp.c:1494
inet_recvmsg+0x13e/0x610 net/ipv4/af_inet.c:775
sock_recvmsg_nosec net/socket.c:742 [inline]
sock_recvmsg+0xd7/0x110 net/socket.c:749
SYSC_recvfrom+0x33a/0x720 net/socket.c:1738
SyS_recvfrom+0x40/0x50 net/socket.c:1711
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x4458b9
RSP: 002b:00007f3f404d7b58 EFLAGS: 00000282 ORIG_RAX: 000000000000002d
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004458b9
RDX: 0000000000000000 RSI: 0000000020cf2ffc RDI: 0000000000000006
RBP: 00000000006e1740 R08: 0000000020cf2ff0 R09: 0000000000000010
R10: 0000000100000042 R11: 0000000000000282 R12: 0000000000708000
R13: 0000000000000016 R14: 0000000020153000 R15: 0000000000000215
Object at ffff880053c46ed8, in cache kmalloc-512 size: 512
Allocated:
PID = 7429
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack+0x43/0xd0 mm/kasan/kasan.c:502
set_track mm/kasan/kasan.c:514 [inline]
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:605
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:544
slab_post_alloc_hook mm/slab.h:432 [inline]
slab_alloc_node mm/slub.c:2715 [inline]
__kmalloc_node_track_caller+0x20e/0x360 mm/slub.c:4262
__kmalloc_reserve.isra.34+0x41/0xd0 net/core/skbuff.c:138
__alloc_skb+0x159/0x800 net/core/skbuff.c:231
alloc_skb include/linux/skbuff.h:926 [inline]
alloc_skb_with_frags+0x12e/0x7b0 net/core/skbuff.c:4657
sock_alloc_send_pskb+0x804/0xa30 net/core/sock.c:1887
sock_alloc_send_skb+0x32/0x40 net/core/sock.c:1904
__ip_append_data.isra.48+0x1780/0x2ca0 net/ipv4/ip_output.c:1028
ip_append_data.part.49+0xe9/0x160 net/ipv4/ip_output.c:1226
ip_append_data+0x68/0x80 net/ipv4/ip_output.c:1215
udp_sendmsg+0x1a1f/0x2b80 net/ipv4/udp.c:1085
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
sock_sendmsg_nosec net/socket.c:635 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:645
SYSC_sendto+0x660/0x810 net/socket.c:1687
SyS_sendto+0x40/0x50 net/socket.c:1655
entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 785
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack+0x43/0xd0 mm/kasan/kasan.c:502
set_track mm/kasan/kasan.c:514 [inline]
kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:578
slab_free_hook mm/slub.c:1355 [inline]
slab_free_freelist_hook mm/slub.c:1377 [inline]
slab_free mm/slub.c:2958 [inline]
kfree+0xe8/0x2b0 mm/slub.c:3878
skb_free_head+0x74/0xb0 net/core/skbuff.c:580
skb_release_data+0x3a7/0x470 net/core/skbuff.c:611
skb_release_all+0x4a/0x60 net/core/skbuff.c:670
__kfree_skb+0x15/0x20 net/core/skbuff.c:684
kfree_skb+0x16e/0x4e0 net/core/skbuff.c:705
netlink_sock_destruct+0x14d/0x400 net/netlink/af_netlink.c:333
__sk_destruct+0xe1/0x6e0 net/core/sock.c:1430
sk_destruct+0x47/0x80 net/core/sock.c:1460
__sk_free+0x57/0x230 net/core/sock.c:1468
sk_free+0x23/0x30 net/core/sock.c:1479
netlink_sock_destruct_work+0x19/0x20 net/netlink/af_netlink.c:353
process_one_work+0xc06/0x1c20 kernel/workqueue.c:2098
worker_thread+0x223/0x19c0 kernel/workqueue.c:2232
kthread+0x326/0x3f0 kernel/kthread.c:227
ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430
Memory state around the buggy address:
ffff880053c47000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff880053c47080: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
>ffff880053c47100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff880053c47180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff880053c47200: fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb
==================================================================
View attachment "udp-csum-oob-poc.c" of type "text/x-csrc" (12725 bytes)
Download attachment ".config" of type "application/octet-stream" (124975 bytes)
Powered by blists - more mailing lists