lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Mon, 7 Dec 2015 11:15:24 -0200
From:	Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
To:	Dmitry Vyukov <dvyukov@...gle.com>
Cc:	Vlad Yasevich <vyasevich@...il.com>,
	netdev <netdev@...r.kernel.org>,
	Eric Dumazet <eric.dumazet@...il.com>,
	syzkaller <syzkaller@...glegroups.com>,
	linux-sctp@...r.kernel.org, Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>
Subject: Re: use-after-free in sctp_do_sm

On Mon, Dec 07, 2015 at 12:26:09PM +0100, Dmitry Vyukov wrote:
> On Sat, Dec 5, 2015 at 5:39 PM, Vlad Yasevich <vyasevich@...il.com> wrote:
> > On 12/04/2015 04:34 PM, Marcelo Ricardo Leitner wrote:
> >> On Fri, Dec 04, 2015 at 09:25:35PM +0100, Dmitry Vyukov wrote:
> >>> On Fri, Dec 4, 2015 at 6:48 PM, Marcelo Ricardo Leitner
> >>> <marcelo.leitner@...il.com> wrote:
> >>>> Hi Dmitry,
> >>>>
> >>>> Can you please test this patch?
> >>>> I'll re-post with proper subject if it works.
> >>>
> >>> Still happening with the same stacks.
> >>
> >> Then there may be another one, I'm afraid.
> >>
> >> I'm using the testapp you shared in the first email, with that debug line
> >> enabled and added a new one:
> >> +       pr_debug("%p %d\n", asoc, asoc ? asoc->state : 0);
> >>         debug_post_sfx();
> >> (should have used %x, but ok)
> >>
> >> Also enabled slub_debug=PUZ, and I get:
> >>
> >> without the patch:
> >> [   87.873640] sctp: ffff8800b71533d8 1
> >> [   87.873647] sctp: sctp_do_sm[post-sfx]: error:0,
> >> asoc:ffff8800b71533d8[STATE_CLOSED]
> >> [   87.873739] sctp: ffff8800b71533d8 1
> >> [   87.873742] sctp: sctp_do_sm[post-sfx]: error:0,
> >> asoc:ffff8800b71533d8[STATE_CLOSED]
> >> [   87.875149] sctp: ffff8800b71533d8 1802201963
> >> [   87.875238] sctp: sctp_do_sm[post-sfx]: error:0,
> >> asoc:ffff8800b71533d8[STATE_CLOSED]
> >>
> >> 1802201963 = 0x6b6b6b6b, poison
> >>
> >> with the patch:
> >> [   81.071265] sctp: ffff880137571148 1
> >> [   81.071273] sctp: sctp_do_sm[post-sfx]: error:0,
> >> asoc:ffff880137571148[STATE_CLOSED]
> >> [   81.071372] sctp: ffff880137571148 1
> >> [   81.071375] sctp: sctp_do_sm[post-sfx]: error:0,
> >> asoc:ffff880137571148[STATE_CLOSED]
> >> [   81.072423] sctp:           (null) 0
> >> [   81.072427] sctp: sctp_do_sm[post-sfx]: error:0, asoc:
> >> (null)[STATE_CLOSED]
> >>
> >> This one, at least, is gone with this patch.
> >>
> >>   Marcelo
> >>
> >
> > Hi Marcelo
> >
> > I think you also need to catch the SCTP_DISPOSITION_ABORT and update
> > the pointer.  There are some issues there though as some functions report
> > that code without actually destroying the association.  This happens when
> > the ABORT chunk may be dropped.
> >
> > I think this might be why we still see the issue.
> 
> 
> Marcelo,
> 
> Is this info enough for you to cook another fix?

Hi, I think so. I was really wondering how you could trigger that issue
without the timestamp fix and Vlad's comment does shed some light on it.

I'll do more tests later today, but what did you have connecting to the
listening socket? Somehow you made that accept() call to return..

  Marcelo

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists