Date:   Wed, 21 Jun 2017 17:02:11 +0200
From:   Andrey Konovalov <andreyknvl@...gle.com>
To:     Ralf Baechle <ralf@...ux-mips.org>,
        "David S. Miller" <davem@...emloft.net>,
        linux-hams@...r.kernel.org, netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Cc:     Dmitry Vyukov <dvyukov@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: net/rose: null-ptr-deref in rose_route_frame

On Fri, Apr 21, 2017 at 3:29 PM, Andrey Konovalov <andreyknvl@...gle.com> wrote:
> Hi,
>
> I've got the following error report while fuzzing the kernel with syzkaller.
>
> On commit 4f7d029b9bf009fbee76bb10c0c4351a1870d2f3 (4.11-rc7).
>
> rose_xmit calls rose_route_frame(skb, ax25 = NULL), and
> rose_route_frame then dereferences ax25 when doing
> ax25cmp(&ax25->dest_addr, &rose_neigh->callsign).

Still see this on 9705596d08ac87c18aee32cc97f2783b7d14624e (4.12-rc6+).

Now have a C reproducer, attached.

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 4282 Comm: a.out Not tainted 4.12.0-rc6+ #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880064250000 task.stack: ffff880069d10000
RIP: 0010:ax25cmp+0x44/0x160 net/ax25/ax25_addr.c:122
RSP: 0018:ffff880069d15130 EFLAGS: 00010202
RAX: ffff880064250000 RBX: ffff880067d23680 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000017
RBP: ffff880069d15168 R08: dffffc0000000000 R09: 0000000000000002
R10: ffff880069d14960 R11: dffffc0000000000 R12: dffffc0000000000
R13: 000000000000001d R14: ffff880067d23688 R15: 0000000000000017
FS:  00007f2fbf36c700(0000) GS:ffff88006ca00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010ff0 CR3: 0000000068492000 CR4: 00000000000006f0
Call Trace:
 rose_route_frame+0x3b6/0x19f0 net/rose/rose_route.c:883
 rose_xmit+0x84/0x180 net/rose/rose_dev.c:110
 __netdev_start_xmit ./include/linux/netdevice.h:4004
 netdev_start_xmit ./include/linux/netdevice.h:4013
 xmit_one net/core/dev.c:2914
 dev_hard_start_xmit+0x253/0xad0 net/core/dev.c:2930
 __dev_queue_xmit+0x1ff2/0x2820 net/core/dev.c:3400
 dev_queue_xmit+0x1c/0x20 net/core/dev.c:3433
 arp_xmit_finish net/ipv4/arp.c:629
 NF_HOOK ./include/linux/netfilter.h:257
 arp_xmit+0xdb/0x580 net/ipv4/arp.c:638
 arp_send_dst.part.17+0x9e/0xc0 net/ipv4/arp.c:316
 arp_send_dst net/ipv4/arp.c:389
 arp_solicit+0x929/0x10f0 net/ipv4/arp.c:388
 neigh_probe+0xcb/0x110 net/core/neighbour.c:865
 __neigh_event_send+0xa61/0xf40 net/core/neighbour.c:1021
 neigh_event_send ./include/net/neighbour.h:432
 neigh_resolve_output+0x6e6/0xa40 net/core/neighbour.c:1300
 neigh_output ./include/net/neighbour.h:479
 ip_finish_output2+0x968/0x15e0 net/ipv4/ip_output.c:228
 ip_finish_output+0xa3a/0xe00 net/ipv4/ip_output.c:316
 NF_HOOK_COND ./include/linux/netfilter.h:246
 ip_output+0x1fb/0x7b0 net/ipv4/ip_output.c:404
 dst_output ./include/net/dst.h:492
 ip_local_out+0x9a/0x170 net/ipv4/ip_output.c:124
 ip_queue_xmit+0x9ad/0x1a10 net/ipv4/ip_output.c:503
 sctp_v4_xmit+0x10d/0x140 net/sctp/protocol.c:994
 sctp_packet_transmit+0x2161/0x3510 net/sctp/output.c:637
 sctp_outq_flush+0xae3/0x3fa0 net/sctp/outqueue.c:895
 sctp_outq_uncork+0x5f/0x70 net/sctp/outqueue.c:760
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1773
 sctp_side_effects net/sctp/sm_sideeffect.c:1175
 sctp_do_sm+0x599/0x6a50 net/sctp/sm_sideeffect.c:1147
 sctp_primitive_ASSOCIATE+0xa2/0xd0 net/sctp/primitive.c:88
 __sctp_connect+0x8cc/0xea0 net/sctp/socket.c:1206
 sctp_connect+0xb9/0xf0 net/sctp/socket.c:4135
 inet_dgram_connect+0x117/0x1f0 net/ipv4/af_inet.c:540
 SYSC_connect+0x251/0x590 net/socket.c:1588
 SyS_connect+0x29/0x30 net/socket.c:1569
 entry_SYSCALL_64_fastpath+0x1f/0xbe arch/x86/entry/entry_64.S:203
RIP: 0033:0x7f2fbea7eb79
RSP: 002b:00007ffc106948f8 EFLAGS: 00000217 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007ffc10694a10 RCX: 00007f2fbea7eb79
RDX: 0000000000000010 RSI: 0000000020010ff0 RDI: 0000000000000005
RBP: 00000000004004e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000010 R11: 0000000000000217 R12: 0000000000000000
R13: 00007ffc10694a10 R14: 0000000000000000 R15: 0000000000000000
Code: 49 89 f6 49 bc 00 00 00 00 00 fc ff df 48 83 ec 10 48 89 7d c8
48 89 75 d0 e8 d9 fb 46 fd 4c 89 f9 4c 89 fe 48 c1 e9 03 83 e6 07 <42>
0f b6 0c 21 40 38 f1 7f 08 84 c9 0f 85 ef 00 00 00 4c 89 f1
RIP: ax25cmp+0x44/0x160 RSP: ffff880069d15130
---[ end trace 0707d4b9b0f5bb8b ]---
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: disabled
---[ end Kernel panic - not syncing: Fatal exception in interrupt

>
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] SMP KASAN
> Dumping ftrace buffer:
>    (ftrace buffer empty)
> Modules linked in:
> CPU: 1 PID: 15 Comm: ksoftirqd/1 Not tainted 4.11.0-rc7+ #251
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> task: ffff88003e10adc0 task.stack: ffff88003e148000
> RIP: 0010:ax25cmp+0x3f/0x150 net/ax25/ax25_addr.c:122
> RSP: 0018:ffff88003e14d450 EFLAGS: 00010202
> RAX: ffff88003e10adc0 RBX: ffff880069c606b8 RCX: 0000000000000002
> RDX: 0000000000000100 RSI: 0000000000000007 RDI: 0000000000000017
> RBP: ffff88003e14d488 R08: dffffc0000000000 R09: 0000000000000000
> R10: 6a8a172cb651d699 R11: dffffc0000000000 R12: dffffc0000000000
> R13: 000000000000001d R14: ffff880069c606c0 R15: 0000000000000017
> FS:  0000000000000000(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000000002044ef69 CR3: 000000005682b000 CR4: 00000000000006e0
> Call Trace:
>  rose_route_frame+0x3b1/0x19f0 net/rose/rose_route.c:883
>  rose_xmit+0x7f/0x180 net/rose/rose_dev.c:110
>  __netdev_start_xmit include/linux/netdevice.h:3980 [inline]
>  netdev_start_xmit include/linux/netdevice.h:3989 [inline]
>  xmit_one net/core/dev.c:2908 [inline]
>  dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:2924
>  __dev_queue_xmit+0x1ff8/0x2840 net/core/dev.c:3391
>  dev_queue_xmit+0x17/0x20 net/core/dev.c:3424
>  bond_dev_queue_xmit+0x185/0x240 drivers/net/bonding/bond_main.c:261
>  bond_xmit_slave_id+0x1fe/0x590 drivers/net/bonding/bond_main.c:3702
>  bond_xmit_roundrobin drivers/net/bonding/bond_main.c:3779 [inline]
>  __bond_start_xmit drivers/net/bonding/bond_main.c:4037 [inline]
>  bond_start_xmit+0xb8a/0x17f0 drivers/net/bonding/bond_main.c:4071
>  __netdev_start_xmit include/linux/netdevice.h:3980 [inline]
>  netdev_start_xmit include/linux/netdevice.h:3989 [inline]
>  xmit_one net/core/dev.c:2908 [inline]
>  dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:2924
>  __dev_queue_xmit+0x1ff8/0x2840 net/core/dev.c:3391
>  dev_queue_xmit+0x17/0x20 net/core/dev.c:3424
>  neigh_connected_output+0x534/0x790 net/core/neighbour.c:1338
>  neigh_output include/net/neighbour.h:478 [inline]
>  ip6_finish_output2+0xbf8/0x2560 net/ipv6/ip6_output.c:123
>  ip6_finish_output+0x302/0x960 net/ipv6/ip6_output.c:149
>  NF_HOOK_COND include/linux/netfilter.h:246 [inline]
>  ip6_output+0x1cb/0x8d0 net/ipv6/ip6_output.c:163
>  dst_output include/net/dst.h:486 [inline]
>  NF_HOOK.constprop.39+0x115/0x650 include/linux/netfilter.h:257
>  mld_sendpack+0x6fc/0xd40 net/ipv6/mcast.c:1660
>  mld_send_cr net/ipv6/mcast.c:1951 [inline]
>  mld_ifc_timer_expire+0x3c3/0x750 net/ipv6/mcast.c:2449
>  call_timer_fn+0x23f/0x810 kernel/time/timer.c:1268
>  expire_timers kernel/time/timer.c:1307 [inline]
>  __run_timers+0x94e/0xcd0 kernel/time/timer.c:1601
>  run_timer_softirq+0x21/0x80 kernel/time/timer.c:1614
>  __do_softirq+0x2fb/0xb7d kernel/softirq.c:284
>  run_ksoftirqd+0x20/0x60 kernel/softirq.c:676
>  smpboot_thread_fn+0x562/0x860 kernel/smpboot.c:164
>  kthread+0x35e/0x430 kernel/kthread.c:231
>  ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430
> Code: 49 89 f6 49 bc 00 00 00 00 00 fc ff df 48 83 ec 10 48 89 7d c8
> 48 89 75 d0 e8 4e 4a 57 fd 4c 89 f9 4c 89 fe 48 c1 e9 03 83 e6 07 <42>
> 0f b6 0c 21 40 38 f1 7f 08 84 c9 0f 85 ef 00 00 00 4c 89 f1
> RIP: ax25cmp+0x3f/0x150 net/ax25/ax25_addr.c:122 RSP: ffff88003e14d450
> ---[ end trace f569731c3e601819 ]---
> Kernel panic - not syncing: Fatal exception in interrupt
> Dumping ftrace buffer:
>    (ftrace buffer empty)
> Kernel Offset: disabled
> Rebooting in 86400 seconds..

View attachment "ax25cmp-crash-poc.c" of type "text/x-csrc" (1908 bytes)

Download attachment ".config" of type "application/octet-stream" (129458 bytes)

Powered by blists - more mailing lists