| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAM0EoM=wqtAF932JK+u7ZOYNF0dAfMHTe7aHM1oyYeMbczzVNA@mail.gmail.com>
Date: Fri, 14 Apr 2023 07:59:10 -0400
From: Jamal Hadi Salim <jhs@...atatu.com>
To: Palash Oswal <oswalpalash@...il.com>
Cc: Cong Wang <xiyou.wangcong@...il.com>,
Jiri Pirko <jiri@...nulli.us>,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org,
LKML <linux-kernel@...r.kernel.org>,
syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
Pedro Tammela <pctammela@...atatu.com>
Subject: Re: KASAN: slab-use-after-free Read in tcf_action_destroy
Will look at this unless someone already has figured it out...
cheers,
jama
On Thu, Apr 13, 2023 at 10:41 PM Palash Oswal <oswalpalash@...il.com> wrote:
>
> Hello,
> I found the following issue using syzkaller with enriched corpus on:
> HEAD commit : 0bcc4025550403ae28d2984bddacafbca0a2f112
> git tree: linux
>
> C Reproducer : https://gist.github.com/oswalpalash/278b6fb713f37fa8d4625d6be703550d
> Kernel .config :
> https://gist.github.com/oswalpalash/d9580b0bfce202b37445fa5fd426e41f
>
> syz-repro :
> r0 = socket$nl_route(0x10, 0x3, 0x0)
> r1 = socket(0x10, 0x3, 0x0)
> r2 = socket(0x10, 0x3, 0x0)
> sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0,
> &(0x7f0000000140)={0x0, 0x140}}, 0x0)
> getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, <r3=>0x0, 0x1,
> 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0xab)
> sendmsg$nl_route_sched(r1, &(0x7f0000005840)={0x0, 0x0,
> &(0x7f0000000780)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000024000b0e00"/20,
> @ANYRES32=r3, @ANYBLOB="00000000ffffffff0000000008000100687462001c0002001800020003"],
> 0x48}}, 0x0)
> sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0,
> &(0x7f0000000180)={&(0x7f00000007c0)=@...tfilter={0x40, 0x2c, 0xd27,
> 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0xfff3}},
> [@filter_kind_options=@...lower={{0xb}, {0x10, 0x2,
> [@TCA_FLOWER_KEY_ETH_DST={0xa, 0x4, @local}]}}]}, 0x40}}, 0x0)
> (fail_nth: 19)
>
>
> Console log :
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in tcf_action_destroy+0x17f/0x1b0
> Read of size 8 at addr ffff88811024d800 by task kworker/u4:1/11
>
> CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted
> 6.3.0-rc6-pasta-00035-g0bcc40255504 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.13.0-1ubuntu1.1 04/01/2014
> Workqueue: tc_filter_workqueue fl_destroy_filter_work
> Call Trace:
> <TASK>
> dump_stack_lvl+0xd9/0x150
> print_address_description.constprop.0+0x2c/0x3c0
> kasan_report+0x11c/0x130
> tcf_action_destroy+0x17f/0x1b0
> tcf_exts_destroy+0xc5/0x160
> __fl_destroy_filter+0x1a/0x100
> process_one_work+0x991/0x15c0
> worker_thread+0x669/0x1090
> kthread+0x2e8/0x3a0
> ret_from_fork+0x1f/0x30
> </TASK>
>
> Allocated by task 9570:
> kasan_save_stack+0x22/0x40
> kasan_set_track+0x25/0x30
> __kasan_kmalloc+0xa3/0xb0
> tcf_exts_init_ex+0xe4/0x5a0
> fl_change+0x56f/0x4a20
> tc_new_tfilter+0x995/0x22a0
> rtnetlink_rcv_msg+0x996/0xd50
> netlink_rcv_skb+0x165/0x440
> netlink_unicast+0x547/0x7f0
> netlink_sendmsg+0x926/0xe30
> sock_sendmsg+0xde/0x190
> ____sys_sendmsg+0x71c/0x900
> ___sys_sendmsg+0x110/0x1b0
> __sys_sendmsg+0xf7/0x1c0
> do_syscall_64+0x39/0xb0
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Freed by task 9570:
> kasan_save_stack+0x22/0x40
> kasan_set_track+0x25/0x30
> kasan_save_free_info+0x2b/0x40
> ____kasan_slab_free+0x13b/0x1a0
> __kmem_cache_free+0xcd/0x2c0
> tcf_exts_destroy+0xe5/0x160
> tcf_exts_init_ex+0x484/0x5a0
> fl_change+0x56f/0x4a20
> tc_new_tfilter+0x995/0x22a0
> rtnetlink_rcv_msg+0x996/0xd50
> netlink_rcv_skb+0x165/0x440
> netlink_unicast+0x547/0x7f0
> netlink_sendmsg+0x926/0xe30
> sock_sendmsg+0xde/0x190
> ____sys_sendmsg+0x71c/0x900
> ___sys_sendmsg+0x110/0x1b0
> __sys_sendmsg+0xf7/0x1c0
> do_syscall_64+0x39/0xb0
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> The buggy address belongs to the object at ffff88811024d800
> which belongs to the cache kmalloc-256 of size 256
> The buggy address is located 0 bytes inside of
> freed 256-byte region [ffff88811024d800, ffff88811024d900)
>
> The buggy address belongs to the physical page:
> page:ffffea0004409340 refcount:1 mapcount:0 mapping:0000000000000000
> index:0x0 pfn:0x11024d
> flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff)
> raw: 057ff00000000200 ffff888012440500 ffffea000436ea10 ffffea00041aec10
> raw: 0000000000000000 ffff88811024d000 0000000100000008 0000000000000000
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask
> 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE),
> pid 8017, tgid 8017 (syz-executor.0), ts 60719725774, free_ts
> 60718847244
> get_page_from_freelist+0x1190/0x2e20
> __alloc_pages+0x1cb/0x4a0
> cache_grow_begin+0x9b/0x3b0
> cache_alloc_refill+0x27f/0x380
> __kmem_cache_alloc_node+0x360/0x3f0
> __kmalloc+0x4e/0x190
> security_sb_alloc+0x105/0x240
> alloc_super+0x236/0xb60
> sget_fc+0x142/0x7c0
> vfs_get_super+0x2d/0x280
> vfs_get_tree+0x8d/0x350
> path_mount+0x1342/0x1e40
> __x64_sys_mount+0x283/0x300
> do_syscall_64+0x39/0xb0
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> page last free stack trace:
> free_pcp_prepare+0x5d5/0xa50
> free_unref_page+0x1d/0x490
> vfree+0x180/0x7e0
> delayed_vfree_work+0x57/0x70
> process_one_work+0x991/0x15c0
> worker_thread+0x669/0x1090
> kthread+0x2e8/0x3a0
> ret_from_fork+0x1f/0x30
>
> Memory state around the buggy address:
> ffff88811024d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff88811024d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> >ffff88811024d800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ^
> ffff88811024d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff88811024d900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ==================================================================
Powered by blists - more mailing lists