| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 4 Apr 2017 15:28:06 +0200
From: Andrey Konovalov <andreyknvl@...gle.com>
To: Vlad Yasevich <vyasevich@...il.com>,
Neil Horman <nhorman@...driver.com>,
"David S. Miller" <davem@...emloft.net>,
linux-sctp@...r.kernel.org, netdev <netdev@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>,
Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
Cc: Dmitry Vyukov <dvyukov@...gle.com>,
Eric Dumazet <edumazet@...gle.com>,
Kostya Serebryany <kcc@...gle.com>,
syzkaller <syzkaller@...glegroups.com>
Subject: net/sctp: list double add warning in sctp_endpoint_add_asoc
Hi,
I've got the following error report while fuzzing the kernel with syzkaller.
On commit a71c9a1c779f2499fb2afc0553e543f18aff6edf (4.11-rc5).
A reproducer and .config are attached.
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4033 at lib/list_debug.c:31 __list_add_valid+0xca/0x120
list_add double add: new=ffff8800681b1198, prev=ffff8800681b1198,
next=ffff880067316098.
Modules linked in:
CPU: 0 PID: 4033 Comm: a.out Not tainted 4.11.0-rc5+ #199
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16
dump_stack+0x292/0x398 lib/dump_stack.c:52
__warn+0x19f/0x1e0 kernel/panic.c:549
warn_slowpath_fmt+0xe0/0x120 kernel/panic.c:564
__list_add_valid+0xca/0x120 lib/list_debug.c:29
__list_add ./include/linux/list.h:59
list_add_tail ./include/linux/list.h:92
sctp_endpoint_add_asoc+0x161/0x3e0 net/sctp/endpointola.c:220
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1293
sctp_side_effects net/sctp/sm_sideeffect.c:1175
sctp_do_sm+0x21b5/0x6a50 net/sctp/sm_sideeffect.c:1147
sctp_primitive_ASSOCIATE+0x9d/0xd0 net/sctp/primitive.c:88
sctp_sendmsg+0x26ec/0x3b20 net/sctp/socket.c:1954
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg+0xca/0x110 net/socket.c:643
___sys_sendmsg+0xa73/0xb90 net/socket.c:1997
__sys_sendmsg+0x138/0x320 net/socket.c:2031
SYSC_sendmsg net/socket.c:2042
SyS_sendmsg+0x2d/0x50 net/socket.c:2038
entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:204
RIP: 0033:0x7f19dd797b79
RSP: 002b:00007f19da6b5d98 EFLAGS: 00000206 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f19da6b69c0 RCX: 00007f19dd797b79
RDX: 0000000000004000 RSI: 000000002047a000 RDI: 0000000000000003
RBP: 00007f19ddc63220 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f19da6b69c0 R14: 00007f19de08e040 R15: 0000000000000003
---[ end trace 19c5e4b11b8569c4 ]---
==================================================================
BUG: KASAN: use-after-free in sctp_do_sm+0x6704/0x6a50 at addr ffff8800681b13c0
Read of size 8 by task a.out/4033
CPU: 1 PID: 4033 Comm: a.out Tainted: G W 4.11.0-rc5+ #199
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16
dump_stack+0x292/0x398 lib/dump_stack.c:52
kasan_object_err+0x1c/0x70 mm/kasan/report.c:164
print_address_description mm/kasan/report.c:202
kasan_report_error mm/kasan/report.c:291
kasan_report+0x252/0x510 mm/kasan/report.c:347
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:368
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1514
sctp_side_effects net/sctp/sm_sideeffect.c:1175
sctp_do_sm+0x6704/0x6a50 net/sctp/sm_sideeffect.c:1147
sctp_primitive_ASSOCIATE+0x9d/0xd0 net/sctp/primitive.c:88
sctp_sendmsg+0x26ec/0x3b20 net/sctp/socket.c:1954
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg+0xca/0x110 net/socket.c:643
___sys_sendmsg+0xa73/0xb90 net/socket.c:1997
__sys_sendmsg+0x138/0x320 net/socket.c:2031
SYSC_sendmsg net/socket.c:2042
SyS_sendmsg+0x2d/0x50 net/socket.c:2038
entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:204
RIP: 0033:0x7f19dd797b79
RSP: 002b:00007f19da6b5d98 EFLAGS: 00000206 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f19da6b69c0 RCX: 00007f19dd797b79
RDX: 0000000000004000 RSI: 000000002047a000 RDI: 0000000000000003
RBP: 00007f19ddc63220 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f19da6b69c0 R14: 00007f19de08e040 R15: 0000000000000003
Object at ffff8800681b1100, in cache kmalloc-4096 size: 4096
Allocated:
PID = 4031
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:513
set_track mm/kasan/kasan.c:525
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616
kmem_cache_alloc_trace+0x82/0x270 mm/slub.c:2745
kmalloc ./include/linux/slab.h:490
kzalloc ./include/linux/slab.h:663
sctp_association_new+0x114/0x2130 net/sctp/associola.c:304
sctp_sendmsg+0x160d/0x3b20 net/sctp/socket.c:1836
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg+0xca/0x110 net/socket.c:643
SYSC_sendto+0x660/0x810 net/socket.c:1696
SyS_sendto+0x40/0x50 net/socket.c:1664
entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:204
Freed:
PID = 4040
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:513
set_track mm/kasan/kasan.c:525
kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:589
slab_free_hook mm/slub.c:1357
slab_free_freelist_hook mm/slub.c:1379
slab_free mm/slub.c:2961
kfree+0xe8/0x2b0 mm/slub.c:3882
sctp_association_destroy net/sctp/associola.c:430
sctp_association_put+0x217/0x310 net/sctp/associola.c:879
sctp_transport_destroy net/sctp/transport.c:183
sctp_transport_put+0x15f/0x1d0 net/sctp/transport.c:328
sctp_backlog_rcv+0x239/0xd50 net/sctp/input.c:356
sk_backlog_rcv ./include/net/sock.h:898
__release_sock+0x127/0x3a0 net/core/sock.c:2069
release_sock+0xa5/0x2b0 net/core/sock.c:2564
sctp_close+0x735/0x9f0 net/sctp/socket.c:1539
inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425
sock_release+0x8d/0x1e0 net/socket.c:597
sock_close+0x16/0x20 net/socket.c:1072
__fput+0x332/0x7f0 fs/file_table.c:209
____fput+0x15/0x20 fs/file_table.c:245
task_work_run+0x19b/0x270 kernel/task_work.c:116
tracehook_notify_resume ./include/linux/tracehook.h:191
exit_to_usermode_loop+0x1c2/0x200 arch/x86/entry/common.c:161
prepare_exit_to_usermode arch/x86/entry/common.c:191
syscall_return_slowpath+0x3d3/0x420 arch/x86/entry/common.c:260
entry_SYSCALL_64_fastpath+0xc0/0xc2 arch/x86/entry/entry_64.S:239
Memory state around the buggy address:
ffff8800681b1280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8800681b1300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8800681b1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8800681b1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8800681b1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
View attachment "sctp-double-add-warn-poc.c" of type "text/x-csrc" (30013 bytes)
Download attachment ".config" of type "application/octet-stream" (96030 bytes)
Powered by blists - more mailing lists