lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 4 Apr 2017 15:28:06 +0200
From:   Andrey Konovalov <andreyknvl@...gle.com>
To:     Vlad Yasevich <vyasevich@...il.com>,
        Neil Horman <nhorman@...driver.com>,
        "David S. Miller" <davem@...emloft.net>,
        linux-sctp@...r.kernel.org, netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
Cc:     Dmitry Vyukov <dvyukov@...gle.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: net/sctp: list double add warning in sctp_endpoint_add_asoc

Hi,

I've got the following error report while fuzzing the kernel with syzkaller.

On commit a71c9a1c779f2499fb2afc0553e543f18aff6edf (4.11-rc5).

A reproducer and .config are attached.

------------[ cut here ]------------
WARNING: CPU: 0 PID: 4033 at lib/list_debug.c:31 __list_add_valid+0xca/0x120
list_add double add: new=ffff8800681b1198, prev=ffff8800681b1198,
next=ffff880067316098.
Modules linked in:
CPU: 0 PID: 4033 Comm: a.out Not tainted 4.11.0-rc5+ #199
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16
 dump_stack+0x292/0x398 lib/dump_stack.c:52
 __warn+0x19f/0x1e0 kernel/panic.c:549
 warn_slowpath_fmt+0xe0/0x120 kernel/panic.c:564
 __list_add_valid+0xca/0x120 lib/list_debug.c:29
 __list_add ./include/linux/list.h:59
 list_add_tail ./include/linux/list.h:92
 sctp_endpoint_add_asoc+0x161/0x3e0 net/sctp/endpointola.c:220
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1293
 sctp_side_effects net/sctp/sm_sideeffect.c:1175
 sctp_do_sm+0x21b5/0x6a50 net/sctp/sm_sideeffect.c:1147
 sctp_primitive_ASSOCIATE+0x9d/0xd0 net/sctp/primitive.c:88
 sctp_sendmsg+0x26ec/0x3b20 net/sctp/socket.c:1954
 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
 sock_sendmsg_nosec net/socket.c:633
 sock_sendmsg+0xca/0x110 net/socket.c:643
 ___sys_sendmsg+0xa73/0xb90 net/socket.c:1997
 __sys_sendmsg+0x138/0x320 net/socket.c:2031
 SYSC_sendmsg net/socket.c:2042
 SyS_sendmsg+0x2d/0x50 net/socket.c:2038
 entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:204
RIP: 0033:0x7f19dd797b79
RSP: 002b:00007f19da6b5d98 EFLAGS: 00000206 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f19da6b69c0 RCX: 00007f19dd797b79
RDX: 0000000000004000 RSI: 000000002047a000 RDI: 0000000000000003
RBP: 00007f19ddc63220 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f19da6b69c0 R14: 00007f19de08e040 R15: 0000000000000003
---[ end trace 19c5e4b11b8569c4 ]---
==================================================================
BUG: KASAN: use-after-free in sctp_do_sm+0x6704/0x6a50 at addr ffff8800681b13c0
Read of size 8 by task a.out/4033
CPU: 1 PID: 4033 Comm: a.out Tainted: G        W       4.11.0-rc5+ #199
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16
 dump_stack+0x292/0x398 lib/dump_stack.c:52
 kasan_object_err+0x1c/0x70 mm/kasan/report.c:164
 print_address_description mm/kasan/report.c:202
 kasan_report_error mm/kasan/report.c:291
 kasan_report+0x252/0x510 mm/kasan/report.c:347
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:368
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1514
 sctp_side_effects net/sctp/sm_sideeffect.c:1175
 sctp_do_sm+0x6704/0x6a50 net/sctp/sm_sideeffect.c:1147
 sctp_primitive_ASSOCIATE+0x9d/0xd0 net/sctp/primitive.c:88
 sctp_sendmsg+0x26ec/0x3b20 net/sctp/socket.c:1954
 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
 sock_sendmsg_nosec net/socket.c:633
 sock_sendmsg+0xca/0x110 net/socket.c:643
 ___sys_sendmsg+0xa73/0xb90 net/socket.c:1997
 __sys_sendmsg+0x138/0x320 net/socket.c:2031
 SYSC_sendmsg net/socket.c:2042
 SyS_sendmsg+0x2d/0x50 net/socket.c:2038
 entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:204
RIP: 0033:0x7f19dd797b79
RSP: 002b:00007f19da6b5d98 EFLAGS: 00000206 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f19da6b69c0 RCX: 00007f19dd797b79
RDX: 0000000000004000 RSI: 000000002047a000 RDI: 0000000000000003
RBP: 00007f19ddc63220 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f19da6b69c0 R14: 00007f19de08e040 R15: 0000000000000003
Object at ffff8800681b1100, in cache kmalloc-4096 size: 4096
Allocated:
PID = 4031
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:513
 set_track mm/kasan/kasan.c:525
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616
 kmem_cache_alloc_trace+0x82/0x270 mm/slub.c:2745
 kmalloc ./include/linux/slab.h:490
 kzalloc ./include/linux/slab.h:663
 sctp_association_new+0x114/0x2130 net/sctp/associola.c:304
 sctp_sendmsg+0x160d/0x3b20 net/sctp/socket.c:1836
 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
 sock_sendmsg_nosec net/socket.c:633
 sock_sendmsg+0xca/0x110 net/socket.c:643
 SYSC_sendto+0x660/0x810 net/socket.c:1696
 SyS_sendto+0x40/0x50 net/socket.c:1664
 entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:204
Freed:
PID = 4040
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x43/0xd0 mm/kasan/kasan.c:513
 set_track mm/kasan/kasan.c:525
 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:589
 slab_free_hook mm/slub.c:1357
 slab_free_freelist_hook mm/slub.c:1379
 slab_free mm/slub.c:2961
 kfree+0xe8/0x2b0 mm/slub.c:3882
 sctp_association_destroy net/sctp/associola.c:430
 sctp_association_put+0x217/0x310 net/sctp/associola.c:879
 sctp_transport_destroy net/sctp/transport.c:183
 sctp_transport_put+0x15f/0x1d0 net/sctp/transport.c:328
 sctp_backlog_rcv+0x239/0xd50 net/sctp/input.c:356
 sk_backlog_rcv ./include/net/sock.h:898
 __release_sock+0x127/0x3a0 net/core/sock.c:2069
 release_sock+0xa5/0x2b0 net/core/sock.c:2564
 sctp_close+0x735/0x9f0 net/sctp/socket.c:1539
 inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425
 sock_release+0x8d/0x1e0 net/socket.c:597
 sock_close+0x16/0x20 net/socket.c:1072
 __fput+0x332/0x7f0 fs/file_table.c:209
 ____fput+0x15/0x20 fs/file_table.c:245
 task_work_run+0x19b/0x270 kernel/task_work.c:116
 tracehook_notify_resume ./include/linux/tracehook.h:191
 exit_to_usermode_loop+0x1c2/0x200 arch/x86/entry/common.c:161
 prepare_exit_to_usermode arch/x86/entry/common.c:191
 syscall_return_slowpath+0x3d3/0x420 arch/x86/entry/common.c:260
 entry_SYSCALL_64_fastpath+0xc0/0xc2 arch/x86/entry/entry_64.S:239
Memory state around the buggy address:
 ffff8800681b1280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8800681b1300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8800681b1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff8800681b1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8800681b1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

View attachment "sctp-double-add-warn-poc.c" of type "text/x-csrc" (30013 bytes)

Download attachment ".config" of type "application/octet-stream" (96030 bytes)

Powered by blists - more mailing lists