| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAGyP=7djcPOF6JHvVV6Zmpvtb_nHsDM7865C3e4A5F06kF8FsQ@mail.gmail.com>
Date: Thu, 13 Apr 2023 19:41:26 -0700
From: Palash Oswal <oswalpalash@...il.com>
To: Jamal Hadi Salim <jhs@...atatu.com>,
Cong Wang <xiyou.wangcong@...il.com>,
Jiri Pirko <jiri@...nulli.us>,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org,
LKML <linux-kernel@...r.kernel.org>,
syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: KASAN: slab-use-after-free Read in tcf_action_destroy
Hello,
I found the following issue using syzkaller with enriched corpus on:
HEAD commit : 0bcc4025550403ae28d2984bddacafbca0a2f112
git tree: linux
C Reproducer : https://gist.github.com/oswalpalash/278b6fb713f37fa8d4625d6be703550d
Kernel .config :
https://gist.github.com/oswalpalash/d9580b0bfce202b37445fa5fd426e41f
syz-repro :
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0,
&(0x7f0000000140)={0x0, 0x140}}, 0x0)
getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, <r3=>0x0, 0x1,
0x0, 0x6, @broadcast}, &(0x7f0000000100)=0xab)
sendmsg$nl_route_sched(r1, &(0x7f0000005840)={0x0, 0x0,
&(0x7f0000000780)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000024000b0e00"/20,
@ANYRES32=r3, @ANYBLOB="00000000ffffffff0000000008000100687462001c0002001800020003"],
0x48}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0,
&(0x7f0000000180)={&(0x7f00000007c0)=@...tfilter={0x40, 0x2c, 0xd27,
0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0xfff3}},
[@filter_kind_options=@...lower={{0xb}, {0x10, 0x2,
[@TCA_FLOWER_KEY_ETH_DST={0xa, 0x4, @local}]}}]}, 0x40}}, 0x0)
(fail_nth: 19)
Console log :
==================================================================
BUG: KASAN: slab-use-after-free in tcf_action_destroy+0x17f/0x1b0
Read of size 8 at addr ffff88811024d800 by task kworker/u4:1/11
CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted
6.3.0-rc6-pasta-00035-g0bcc40255504 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Workqueue: tc_filter_workqueue fl_destroy_filter_work
Call Trace:
<TASK>
dump_stack_lvl+0xd9/0x150
print_address_description.constprop.0+0x2c/0x3c0
kasan_report+0x11c/0x130
tcf_action_destroy+0x17f/0x1b0
tcf_exts_destroy+0xc5/0x160
__fl_destroy_filter+0x1a/0x100
process_one_work+0x991/0x15c0
worker_thread+0x669/0x1090
kthread+0x2e8/0x3a0
ret_from_fork+0x1f/0x30
</TASK>
Allocated by task 9570:
kasan_save_stack+0x22/0x40
kasan_set_track+0x25/0x30
__kasan_kmalloc+0xa3/0xb0
tcf_exts_init_ex+0xe4/0x5a0
fl_change+0x56f/0x4a20
tc_new_tfilter+0x995/0x22a0
rtnetlink_rcv_msg+0x996/0xd50
netlink_rcv_skb+0x165/0x440
netlink_unicast+0x547/0x7f0
netlink_sendmsg+0x926/0xe30
sock_sendmsg+0xde/0x190
____sys_sendmsg+0x71c/0x900
___sys_sendmsg+0x110/0x1b0
__sys_sendmsg+0xf7/0x1c0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 9570:
kasan_save_stack+0x22/0x40
kasan_set_track+0x25/0x30
kasan_save_free_info+0x2b/0x40
____kasan_slab_free+0x13b/0x1a0
__kmem_cache_free+0xcd/0x2c0
tcf_exts_destroy+0xe5/0x160
tcf_exts_init_ex+0x484/0x5a0
fl_change+0x56f/0x4a20
tc_new_tfilter+0x995/0x22a0
rtnetlink_rcv_msg+0x996/0xd50
netlink_rcv_skb+0x165/0x440
netlink_unicast+0x547/0x7f0
netlink_sendmsg+0x926/0xe30
sock_sendmsg+0xde/0x190
____sys_sendmsg+0x71c/0x900
___sys_sendmsg+0x110/0x1b0
__sys_sendmsg+0xf7/0x1c0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff88811024d800
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 0 bytes inside of
freed 256-byte region [ffff88811024d800, ffff88811024d900)
The buggy address belongs to the physical page:
page:ffffea0004409340 refcount:1 mapcount:0 mapping:0000000000000000
index:0x0 pfn:0x11024d
flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000000200 ffff888012440500 ffffea000436ea10 ffffea00041aec10
raw: 0000000000000000 ffff88811024d000 0000000100000008 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask
0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE),
pid 8017, tgid 8017 (syz-executor.0), ts 60719725774, free_ts
60718847244
get_page_from_freelist+0x1190/0x2e20
__alloc_pages+0x1cb/0x4a0
cache_grow_begin+0x9b/0x3b0
cache_alloc_refill+0x27f/0x380
__kmem_cache_alloc_node+0x360/0x3f0
__kmalloc+0x4e/0x190
security_sb_alloc+0x105/0x240
alloc_super+0x236/0xb60
sget_fc+0x142/0x7c0
vfs_get_super+0x2d/0x280
vfs_get_tree+0x8d/0x350
path_mount+0x1342/0x1e40
__x64_sys_mount+0x283/0x300
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
free_pcp_prepare+0x5d5/0xa50
free_unref_page+0x1d/0x490
vfree+0x180/0x7e0
delayed_vfree_work+0x57/0x70
process_one_work+0x991/0x15c0
worker_thread+0x669/0x1090
kthread+0x2e8/0x3a0
ret_from_fork+0x1f/0x30
Memory state around the buggy address:
ffff88811024d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88811024d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88811024d800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88811024d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88811024d900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Powered by blists - more mailing lists