Date:	Sat, 28 Nov 2015 16:50:56 +0100
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	syzkaller <syzkaller@...glegroups.com>
Cc:	Neil Horman <nhorman@...driver.com>, linux-sctp@...r.kernel.org,
	netdev <netdev@...r.kernel.org>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>,
	Eric Dumazet <edumazet@...gle.com>,
	Maciej Żenczykowski <maze@...gle.com>
Subject: Re: use-after-free in sctp_do_sm

On Wed, Nov 25, 2015 at 4:12 PM, Vlad Yasevich <vyasevich@...il.com> wrote:
> On 11/24/2015 03:45 PM, Neil Horman wrote:
>> On Tue, Nov 24, 2015 at 11:10:32AM +0100, Dmitry Vyukov wrote:
>>> On Tue, Nov 24, 2015 at 10:31 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
>>>> On Tue, Nov 24, 2015 at 10:15 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
>>>>> Hello,
>>>>>
>>>>> The following program triggers use-after-free in sctp_do_sm:
>>>>>
>>>>> // autogenerated by syzkaller (http://github.com/google/syzkaller)
>>>>> #include <syscall.h>
>>>>> #include <string.h>
>>>>> #include <stdint.h>
>>>>>
>>>>> int main()
>>>>> {
>>>>>         long r0 = syscall(SYS_socket, 0xaul, 0x80805ul, 0x0ul, 0, 0, 0);
>>>>>         long r1 = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul,
>>>>> 0x32ul, 0xfffffffffffffffful, 0x0ul);
>>>>>         memcpy((void*)0x20002fe4,
>>>>> "\x0a\x00\x33\xe7\xeb\x9d\xcf\x61\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xc5\xc8\x88\x64",
>>>>> 28);
>>>>>         long r3 = syscall(SYS_bind, r0, 0x20002fe4ul, 0x1cul, 0, 0, 0);
>>>>>         memcpy((void*)0x20000faa,
>>>>> "\x9b\x01\x7d\xcd\xb8\x6a\xc7\x3d\x09\x3a\x07\x00\xa7\xc4\xe9\xee\x0a\xd6\xec\xde\x26\x75\x5f\x22\xae\x4e\x33\x00\xb0\x76\x10\x70\xd6\xca\x19\xbc\x15\x83\xcf\x2e\xbc\x99\x0c\x5e\x83\x89\xc1\x44\x9c\x6e\x74\xd8\x5d\x5d\xd0\xf0\xdf\x47\xc0\x00\x71\x0b\x55\x4c\xab\xf0\xd8\x90\xd5\x92\x8c\x6e\x33\x22\x15\x5b\x19\xfb\xed\xdd\xa6\xac\xcb\x60\xcf\xe2\xde\xed\xdb\x95\x5c\xaa\x20\xa3",
>>>>> 94);
>>>>>         memcpy((void*)0x2000033a,
>>>>> "\x02\x00\x33\xe2\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
>>>>> 128);
>>>>>         long r6 = syscall(SYS_sendto, r0, 0x20000faaul, 0x5eul,
>>>>> 0x81ul, 0x2000033aul, 0x80ul);
>>>>>         return 0;
>>>>> }
>>>>>
>>>>>
>>>>> ==================================================================
>>>>> BUG: KASAN: use-after-free in sctp_do_sm+0x42f6/0x4f60 at addr ffff880036fa80a8
>>>>> Read of size 4 by task a.out/5664
>>>>> =============================================================================
>>>>> BUG kmalloc-4096 (Tainted: G    B          ): kasan: bad access detected
>>>>> -----------------------------------------------------------------------------
>>>>>
>>>>> INFO: Allocated in sctp_association_new+0x6f/0x1ea0 age=8 cpu=1 pid=5664
>>>>> [<      none      >] kmem_cache_alloc_trace+0x1cf/0x220 ./mm/slab.c:3707
>>>>> [<      none      >] sctp_association_new+0x6f/0x1ea0
>>>>> [<      none      >] sctp_sendmsg+0x1954/0x28e0
>>>>> [<      none      >] inet_sendmsg+0x316/0x4f0 ./net/ipv4/af_inet.c:802
>>>>> [<     inline     >] __sock_sendmsg_nosec ./net/socket.c:641
>>>>> [<     inline     >] __sock_sendmsg ./net/socket.c:651
>>>>> [<      none      >] sock_sendmsg+0xca/0x110 ./net/socket.c:662
>>>>> [<      none      >] SYSC_sendto+0x208/0x350 ./net/socket.c:1841
>>>>> [<      none      >] SyS_sendto+0x40/0x50 ./net/socket.c:1862
>>>>> [<      none      >] entry_SYSCALL_64_fastpath+0x16/0x7a
>>>>>
>>>>> INFO: Freed in sctp_association_put+0x150/0x250 age=14 cpu=1 pid=5664
>>>>> [<      none      >] kfree+0x199/0x1b0 ./mm/slab.c:1211
>>>>> [<      none      >] sctp_association_put+0x150/0x250
>>>>> [<      none      >] sctp_association_free+0x498/0x630
>>>>> [<      none      >] sctp_do_sm+0xd8b/0x4f60
>>>>> [<      none      >] sctp_primitive_SHUTDOWN+0xa9/0xd0
>>>>> [<      none      >] sctp_close+0x616/0x790
>>>>> [<      none      >] inet_release+0xed/0x1c0 ./net/ipv4/af_inet.c:471
>>>>> [<      none      >] inet6_release+0x50/0x70 ./net/ipv6/af_inet6.c:416
>>>>> [<     inline     >] constant_test_bit ././arch/x86/include/asm/bitops.h:321
>>>>> [<      none      >] sock_release+0x8d/0x200 ./net/socket.c:601
>>>>> [<      none      >] sock_close+0x16/0x20 ./net/socket.c:1188
>>>>> [<      none      >] __fput+0x21d/0x6e0 ./fs/file_table.c:265
>>>>> [<      none      >] ____fput+0x15/0x20 ./fs/file_table.c:84
>>>>> [<      none      >] task_work_run+0x163/0x1f0 ./include/trace/events/rcu.h:20
>>>>> [<     inline     >] __list_add ./include/linux/list.h:42
>>>>> [<     inline     >] list_add_tail ./include/linux/list.h:76
>>>>> [<     inline     >] list_move_tail ./include/linux/list.h:168
>>>>> [<     inline     >] reparent_leader ./kernel/exit.c:618
>>>>> [<     inline     >] forget_original_parent ./kernel/exit.c:669
>>>>> [<     inline     >] exit_notify ./kernel/exit.c:697
>>>>> [<      none      >] do_exit+0x809/0x2b90 ./kernel/exit.c:878
>>>>> [<      none      >] do_group_exit+0x108/0x320 ./kernel/exit.c:985
>>>>>
>>>>> INFO: Slab 0xffffea0000dbea00 objects=7 used=1 fp=0xffff880036fa8000
>>>>> flags=0x100000000004080
>>>>> INFO: Object 0xffff880036fa8000 @offset=0 fp=0xffff880036fad668
>>>>> CPU: 1 PID: 5664 Comm: a.out Tainted: G    B           4.4.0-rc1+ #81
>>>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>>>>>  00000000ffffffff ffff880061d6f700 ffffffff825d3336 ffff88003e806d00
>>>>>  ffff880036fa8000 ffff880036fa8000 ffff880061d6f730 ffffffff81618784
>>>>>  ffff88003e806d00 ffffea0000dbea00 ffff880036fa8000 0000000000000000
>>>>>
>>>>> Call Trace:
>>>>>  [<ffffffff8162131e>] __asan_report_load4_noabort+0x3e/0x40
>>>>>  [<ffffffff8475ac76>] sctp_do_sm+0x42f6/0x4f60
>>>>>  [<ffffffff847b50e9>] sctp_primitive_SHUTDOWN+0xa9/0xd0
>>>>>  [<ffffffff847a1426>] sctp_close+0x616/0x790
>>>>>  [<ffffffff8409bb0d>] inet_release+0xed/0x1c0 ./net/ipv4/af_inet.c:471
>>>>>  [<ffffffff84192cc0>] inet6_release+0x50/0x70 ./net/ipv6/af_inet6.c:416
>>>>>  [<     inline     >] constant_test_bit ././arch/x86/include/asm/bitops.h:321
>>>>>  [<ffffffff83dc78cd>] sock_release+0x8d/0x200 ./net/socket.c:601
>>>>>  [<ffffffff83dc7a56>] sock_close+0x16/0x20 ./net/socket.c:1188
>>>>>  [<ffffffff81662f5d>] __fput+0x21d/0x6e0 ./fs/file_table.c:265
>>>>>  [<ffffffff816634a5>] ____fput+0x15/0x20 ./fs/file_table.c:84
>>>>>  [<ffffffff812a33d3>] task_work_run+0x163/0x1f0 ./include/trace/events/rcu.h:20
>>>>>  [<     inline     >] __list_add ./include/linux/list.h:42
>>>>>  [<     inline     >] list_add_tail ./include/linux/list.h:76
>>>>>  [<     inline     >] list_move_tail ./include/linux/list.h:168
>>>>>  [<     inline     >] reparent_leader ./kernel/exit.c:618
>>>>>  [<     inline     >] forget_original_parent ./kernel/exit.c:669
>>>>>  [<     inline     >] exit_notify ./kernel/exit.c:697
>>>>>  [<ffffffff812505d9>] do_exit+0x809/0x2b90 ./kernel/exit.c:878
>>>>>  [<ffffffff81252ad8>] do_group_exit+0x108/0x320 ./kernel/exit.c:985
>>>>>  [<ffffffff81252d0d>] SyS_exit_group+0x1d/0x20 ./kernel/exit.c:1002
>>>>>  [<ffffffff84bf0c36>] entry_SYSCALL_64_fastpath+0x16/0x7a
>>>>> ==================================================================
>>>>>
>>>>>
>>>>> I am on commit 90b55590c43258a157a2a143748455dcc50fbb53 of net-next (Nov 22).
>>>
>>> The right commit is:
>>>
>>> commit 7d267278a9ece963d77eefec61630223fce08c6c
>>> Author: Rainer Weikusat
>>> Date:   Fri Nov 20 22:07:23 2015 +0000
>>>     unix: avoid use-after-free in ep_remove_wait_queue
>> This commit doesn't seem to exist
>
> I don't think this matters...  I think what's happening is that a close is happening on a
> socket still in connection initialization phase and we've never handled that particularly
> well...
>
> Net-next kernel with mem debugging hangs on boot for me with a ton of printks suppressed.
> Will try the net kernel to see if that's better


This also seems to lead the the following WARNINGS:

------------[ cut here ]------------
WARNING: CPU: 3 PID: 21734 at kernel/jump_label.c:77
__static_key_slow_dec+0xfb/0x120()
jump label: negative count!
Modules linked in:
CPU: 3 PID: 21734 Comm: executor Tainted: G    B   W       4.4.0-rc2+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 00000000ffffffff ffff88006083f660 ffffffff82719fc6 ffff88006083f6d0
 ffff88003bbf8000 ffffffff85a612e0 ffff88006083f6a0 ffffffff81244ec9
 ffffffff8152c54b ffffed000c107ed6 ffffffff85a612e0 000000000000004d
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82719fc6>] dump_stack+0x68/0x92 lib/dump_stack.c:50
 [<ffffffff81244ec9>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:460
 [<ffffffff81244fd9>] warn_slowpath_fmt+0xa9/0xd0 kernel/panic.c:472
 [<ffffffff8152c54b>] __static_key_slow_dec+0xfb/0x120 kernel/jump_label.c:76
 [<ffffffff8152c5c1>] static_key_slow_dec+0x51/0x90 kernel/jump_label.c:100
 [<ffffffff84962d9b>] net_disable_timestamp+0x3b/0x50 net/core/dev.c:1709
 [<ffffffff84914d43>] sock_disable_timestamp+0x93/0xb0 net/core/sock.c:444
 [<ffffffff8491f82c>] sk_destruct+0xec/0x440 net/core/sock.c:1457
 [<ffffffff8491fbd7>] __sk_free+0x57/0x200 net/core/sock.c:1476
 [<ffffffff8491fdb0>] sk_free+0x30/0x40 net/core/sock.c:1487
 [<     inline     >] sock_put include/net/sock.h:1623
 [<ffffffff854c8a18>] sctp_close+0x628/0x790 net/sctp/socket.c:1546
 [<ffffffff84d4b3ed>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:413
 [<ffffffff84e70240>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:406
 [<ffffffff84909bbd>] sock_release+0x8d/0x1d0 net/socket.c:571
 [<ffffffff84909d16>] sock_close+0x16/0x20 net/socket.c:1022
 [<ffffffff81663a00>] __fput+0x220/0x770 fs/file_table.c:208
 [<ffffffff81663fd5>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8129f673>] task_work_run+0x163/0x1f0 kernel/task_work.c:115
 [<     inline     >] exit_task_work include/linux/task_work.h:21
 [<ffffffff8124d9e9>] do_exit+0x809/0x2ae0 kernel/exit.c:750
 [<ffffffff8124fe38>] do_group_exit+0x108/0x320 kernel/exit.c:880
 [<ffffffff81271df7>] get_signal+0x597/0x1630 kernel/signal.c:2307
 [<ffffffff8114c77f>] do_signal+0x7f/0x18e0 arch/x86/kernel/signal.c:709
 [<ffffffff81003901>] exit_to_usermode_loop+0xf1/0x1a0
arch/x86/entry/common.c:247
 [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:282
 [<ffffffff8100616f>] syscall_return_slowpath+0x19f/0x210
arch/x86/entry/common.c:344
 [<ffffffff85955362>] int_ret_from_sys_call+0x25/0x9f
arch/x86/entry/entry_64.S:281
---[ end trace 3e42717665ff2020 ]---


These WARNINGS always go with the original use-after-free reports. And
I was not able to reproduce this WARNING with commented out
sctp_association_destroy.

For the reference here is syzkaller program that triggers the WARNING.

r0 = socket(0xa, 0x1, 0x84)
mmap(&(0x7f0000000000)=nil, (0x10000), 0x3, 0x32, 0xffffffffffffffff, 0x0)
bind(r0, &(0x7f0000000000)="0a0033e049d02e70000000000000000000000000000000014c37ffc4",
0x1c)
connect(r0, &(0x7f0000001000)="020033d97f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
0x80)
setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000001000+0x336)=0x1, 0x4)
listen(r0, 0xbb3)
r1 = accept(r0, &(0x7f0000003000+0xfd6)=nil, &(0x7f0000004000-0x2)=nil)
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists