netdev - net/sctp: sock memory leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CACT4Y+bf9h=vVSb82Jdv2GeV1MQPg15LW_AcV2BOw-XbMfNetw@mail.gmail.com>
Date:	Wed, 30 Dec 2015 21:42:27 +0100
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	Vlad Yasevich <vyasevich@...il.com>,
	Neil Horman <nhorman@...driver.com>,
	"David S. Miller" <davem@...emloft.net>,
	linux-sctp@...r.kernel.org, netdev <netdev@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>
Cc:	syzkaller <syzkaller@...glegroups.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>,
	Eric Dumazet <edumazet@...gle.com>
Subject: net/sctp: sock memory leak

Hello,

The following program leads to a leak of two sock objects:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <stdint.h>
#include <pthread.h>

int fd;

void *thr(void *arg)
{
        memcpy((void*)0x2000bbbe,
"\x0a\x00\x33\xdc\x14\x4d\x5b\xd1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\xdd\x01\xf8\xfd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
128);
        syscall(SYS_sendto, fd, 0x2000b000ul, 0x70ul, 0x8000ul,
0x2000bbbeul, 0x80ul);
        return 0;
}

int main()
{
        long i;
        pthread_t th[6];

        syscall(SYS_mmap, 0x20000000ul, 0x20000ul, 0x3ul, 0x32ul,
0xfffffffffffffffful, 0x0ul);
        fd = syscall(SYS_socket, 0xaul, 0x1ul, 0x84ul, 0, 0, 0);
        memcpy((void*)0x20003000,
"\x02\x00\x33\xdf\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",
128);
        syscall(SYS_bind, fd, 0x20003000ul, 0x80ul, 0, 0, 0);
        pthread_create(&th[0], 0, thr, (void*)0);
        usleep(100000);
        syscall(SYS_listen, fd, 0x3ul, 0, 0, 0, 0);
        syscall(SYS_accept, fd, 0x20005f80ul, 0x20003000ul, 0, 0, 0);
        return 0;
}


unreferenced object 0xffff8800342540c0 (size 1864):
  comm "a.out", pid 24109, jiffies 4299060398 (age 27.984s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    0a 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
  backtrace:
    [<ffffffff85c73a22>] kmemleak_alloc+0x72/0xc0 mm/kmemleak.c:915
    [<     inline     >] kmemleak_alloc_recursive include/linux/kmemleak.h:47
    [<     inline     >] slab_post_alloc_hook mm/slub.c:1335
    [<     inline     >] slab_alloc_node mm/slub.c:2594
    [<     inline     >] slab_alloc mm/slub.c:2602
    [<ffffffff816cc14d>] kmem_cache_alloc+0x12d/0x2c0 mm/slub.c:2607
    [<ffffffff84b642c9>] sk_prot_alloc+0x69/0x340 net/core/sock.c:1344
    [<ffffffff84b6d36a>] sk_alloc+0x3a/0x6b0 net/core/sock.c:1419
    [<ffffffff850c6d57>] inet6_create+0x2d7/0x1000 net/ipv6/af_inet6.c:173
    [<ffffffff84b5f47c>] __sock_create+0x37c/0x640 net/socket.c:1162
    [<     inline     >] sock_create net/socket.c:1202
    [<     inline     >] SYSC_socket net/socket.c:1232
    [<ffffffff84b5f96f>] SyS_socket+0xef/0x1b0 net/socket.c:1212
    [<ffffffff85c8eaf6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
    [<ffffffffffffffff>] 0xffffffffffffffff
unreferenced object 0xffff880034253780 (size 1864):
  comm "a.out", pid 24109, jiffies 4299060500 (age 27.882s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 33 dc 00 00  ............3...
    0a 00 07 40 00 00 00 00 d8 40 25 34 00 88 ff ff  ...@.....@......
  backtrace:
    [<ffffffff85c73a22>] kmemleak_alloc+0x72/0xc0 mm/kmemleak.c:915
    [<     inline     >] kmemleak_alloc_recursive include/linux/kmemleak.h:47
    [<     inline     >] slab_post_alloc_hook mm/slub.c:1335
    [<     inline     >] slab_alloc_node mm/slub.c:2594
    [<     inline     >] slab_alloc mm/slub.c:2602
    [<ffffffff816cc14d>] kmem_cache_alloc+0x12d/0x2c0 mm/slub.c:2607
    [<ffffffff84b642c9>] sk_prot_alloc+0x69/0x340 net/core/sock.c:1344
    [<ffffffff84b6d36a>] sk_alloc+0x3a/0x6b0 net/core/sock.c:1419
    [<ffffffff85750e00>] sctp_v6_create_accept_sk+0xf0/0x790 net/sctp/ipv6.c:646
    [<ffffffff857242a9>] sctp_accept+0x409/0x6d0 net/sctp/socket.c:3925
    [<ffffffff84fa33b3>] inet_accept+0xe3/0x660 net/ipv4/af_inet.c:671
    [<ffffffff84b5a68c>] SYSC_accept4+0x32c/0x630 net/socket.c:1474
    [<     inline     >] SyS_accept4 net/socket.c:1424
    [<     inline     >] SYSC_accept net/socket.c:1508
    [<ffffffff84b601e6>] SyS_accept+0x26/0x30 net/socket.c:1505
    [<ffffffff85c8eaf6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
    [<ffffffffffffffff>] 0xffffffffffffffff

On commit 8513342170278468bac126640a5d2d12ffbff106 (Dec 28).
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html