netdev - net/ipv4: divide error in __tcp_select

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADUsjNnba_AmnTdoY45Bh7HasqjmBja-W1+-+6eMt-d_dCs2qA@mail.gmail.com>
Date:   Thu, 31 Aug 2017 13:56:09 +0800
From:   idaifish <idaifish@...il.com>
To:     davem@...emloft.net, Alexey Kuznetsov <kuznet@....inr.ac.ru>
Cc:     netdev@...r.kernel.org, syzkaller@...glegroups.com
Subject: net/ipv4: divide error in __tcp_select_window

Hi:
   This bug seems still can be triggered by the attached PoC on latest
Ubuntu1604 (4.4.0-94-generic)

============================================================================
divide error: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 14933 Comm: syz-executor0 Not tainted 4.9.45 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
task: ffff880076ab9900 task.stack: ffff880062ae8000
RIP: 0010:[<ffffffff829c1df3>]  [<ffffffff829c1df3>]
__tcp_select_window+0x2f3/0x6b0 net/ipv4/tcp_output.c:2499
RSP: 0018:ffff880062aef6e8  EFLAGS: 00010283
RAX: 00000000000000ac RBX: 0000000000000000 RCX: ffffc9000195b000
RDX: 0000000000000000 RSI: 0000000000000436 RDI: ffff880079add085
RBP: ffff880062aef728 R08: 0000000000001800 R09: 0000000000000002
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000000ac
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
FS:  00007f15c239a700(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002001c000 CR3: 0000000079628000 CR4: 00000000000006f0
DR0: 0000000000008000 DR1: 0000000000008000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Stack:
 ffff880062aef6e8 ffff880062aef6e8 0000000000000000 ffff880079adca40
 0000000000000000 0000000000000436 ffff880079adcae8 0000000000000436
 ffff880062aef758 ffffffff8297c36e 0000000000000068 0000000000000000
Call Trace:
 [<ffffffff8297c36e>] tcp_cleanup_rbuf+0x43e/0x4f0 net/ipv4/tcp.c:1468
 [<ffffffff829815df>] tcp_recvmsg+0xc2f/0x25d0 net/ipv4/tcp.c:1937
 [<ffffffff82a3c32e>] inet_recvmsg+0x26e/0x3b0 net/ipv4/af_inet.c:765
 [<ffffffff827c84aa>] sock_recvmsg_nosec+0x8a/0xb0 net/socket.c:723
 [<ffffffff827d0849>] ___sys_recvmsg+0x229/0x510 net/socket.c:2113
 [<ffffffff827d25fe>] __sys_recvmmsg+0x23e/0x660 net/socket.c:2221
 [<ffffffff827d2aff>] SYSC_recvmmsg net/socket.c:2302 [inline]
 [<ffffffff827d2aff>] SyS_recvmmsg+0xdf/0x180 net/socket.c:2286
 [<ffffffff82dfb3b7>] entry_SYSCALL_64_fastpath+0x1a/0xa9
Code: ec 7c 1f e8 b0 44 9d fe 44 3b 75 d4 75 c2 e8 a5 44 9d fe 8b 45
d0 44 01 e8 41 39 c4 41 0f 4f dc eb ae e8 91 44 9d fe 44 89 e0 99 <41>
f7 fe 41 0f af c6 89 c3 eb 9a e8 7d 44 9d fe 48 8d bb 91 04
RIP  [<ffffffff829c1df3>] __tcp_select_window+0x2f3/0x6b0
net/ipv4/tcp_output.c:2499
 RSP <ffff880062aef6e8>
---[ end trace 771dfab907a5c7aa ]---
Kernel panic - not syncing: Fatal exception
Kernel Offset: disabled
Rebooting in 86400 seconds..
================================================================================


-- 
Regards,
idaifish

View attachment "report.txt" of type "text/plain" (2334 bytes)

View attachment "poc.c" of type "text/x-csrc" (38406 bytes)