From: Eric Biggers <ebiggers@kernel.org>
To: Arnd Bergmann <arnd@arndb.de>, Al Viro <viro@zeniv.linux.org.uk>
Cc: syzbot <syzbot+eb853b51b10f1befa0b7@syzkaller.appspotmail.com>,
ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net,
davem@davemloft.net, hawk@kernel.org,
jakub.kicinski@netronome.com, john.fastabend@gmail.com,
kafai@fb.com, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-ppp@vger.kernel.org,
netdev@vger.kernel.org, paulus@samba.org, songliubraving@fb.com,
syzkaller-bugs@googlegroups.com, yhs@fb.com
Subject: Re: KASAN: slab-out-of-bounds Read in bpf_prog_create
Date: Wed, 4 Dec 2019 21:22:20 -0800 [thread overview]
Message-ID: <20191205052220.GC1158@sol.localdomain> (raw)
In-Reply-To: <20190928031510.GD1079@sol.localdomain>
Arnd and Al,
On Fri, Sep 27, 2019 at 08:15:10PM -0700, Eric Biggers wrote:
> Arnd and Al,
>
> On Tue, Sep 17, 2019 at 11:49:06AM -0700, syzbot wrote:
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit: 2015a28f Add linux-next specific files for 20190915
> > git tree: linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x=11880d69600000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=110691c2286b679a
> > dashboard link: https://syzkaller.appspot.com/bug?extid=eb853b51b10f1befa0b7
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127c3481600000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1150a70d600000
> >
> > The bug was bisected to:
> >
> > commit 2f4fa2db75e26995709043c8d3de4632ebed5c4b
> > Author: Al Viro <viro@zeniv.linux.org.uk>
> > Date: Thu Apr 18 03:48:01 2019 +0000
> >
> > compat_ioctl: unify copy-in of ppp filters
> >
> > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=145eee1d600000
> > final crash: https://syzkaller.appspot.com/x/report.txt?x=165eee1d600000
> > console output: https://syzkaller.appspot.com/x/log.txt?x=125eee1d600000
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+eb853b51b10f1befa0b7@syzkaller.appspotmail.com
> > Fixes: 2f4fa2db75e2 ("compat_ioctl: unify copy-in of ppp filters")
> >
> > ==================================================================
> > BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:404 [inline]
> > BUG: KASAN: slab-out-of-bounds in bpf_prog_create+0xe9/0x250
> > net/core/filter.c:1351
> > Read of size 32768 at addr ffff88809cf74000 by task syz-executor183/8575
> >
> > CPU: 0 PID: 8575 Comm: syz-executor183 Not tainted 5.3.0-rc8-next-20190915
> > #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > Google 01/01/2011
> > Call Trace:
> > __dump_stack lib/dump_stack.c:77 [inline]
> > dump_stack+0x172/0x1f0 lib/dump_stack.c:113
> > print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
> > __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
> > kasan_report+0x12/0x20 mm/kasan/common.c:634
> > check_memory_region_inline mm/kasan/generic.c:185 [inline]
> > check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192
> > memcpy+0x24/0x50 mm/kasan/common.c:122
> > memcpy include/linux/string.h:404 [inline]
> > bpf_prog_create+0xe9/0x250 net/core/filter.c:1351
> > get_filter.isra.0+0x108/0x1a0 drivers/net/ppp/ppp_generic.c:572
> > ppp_get_filter drivers/net/ppp/ppp_generic.c:584 [inline]
> > ppp_ioctl+0x129d/0x2590 drivers/net/ppp/ppp_generic.c:801
>
> This is a correct bisection. This commit needs:
>
> diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
> index 267fe2c58087..f55d7937d6c5 100644
> --- a/drivers/net/ppp/ppp_generic.c
> +++ b/drivers/net/ppp/ppp_generic.c
> @@ -564,8 +564,9 @@ static struct bpf_prog *get_filter(struct sock_fprog *uprog)
> return NULL;
>
> /* uprog->len is unsigned short, so no overflow here */
> - fprog.len = uprog->len * sizeof(struct sock_filter);
> - fprog.filter = memdup_user(uprog->filter, fprog.len);
> + fprog.len = uprog->len;
> + fprog.filter = memdup_user(uprog->filter,
> + uprog->len * sizeof(struct sock_filter));
> if (IS_ERR(fprog.filter))
> return ERR_CAST(fprog.filter);
>
Why did you ignore this and merge the buggy commit to mainline anyway?
I even told you how to fix it...
- Eric
WARNING: multiple messages have this Message-ID (diff)
From: Eric Biggers <ebiggers@kernel.org>
To: Arnd Bergmann <arnd@arndb.de>, Al Viro <viro@zeniv.linux.org.uk>
Cc: syzbot <syzbot+eb853b51b10f1befa0b7@syzkaller.appspotmail.com>,
ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net,
davem@davemloft.net, hawk@kernel.org,
jakub.kicinski@netronome.com, john.fastabend@gmail.com,
kafai@fb.com, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-ppp@vger.kernel.org,
netdev@vger.kernel.org, paulus@samba.org, songliubraving@fb.com,
syzkaller-bugs@googlegroups.com, yhs@fb.com
Subject: Re: KASAN: slab-out-of-bounds Read in bpf_prog_create
Date: Thu, 05 Dec 2019 05:22:20 +0000 [thread overview]
Message-ID: <20191205052220.GC1158@sol.localdomain> (raw)
In-Reply-To: <20190928031510.GD1079@sol.localdomain>
Arnd and Al,
On Fri, Sep 27, 2019 at 08:15:10PM -0700, Eric Biggers wrote:
> Arnd and Al,
>
> On Tue, Sep 17, 2019 at 11:49:06AM -0700, syzbot wrote:
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit: 2015a28f Add linux-next specific files for 20190915
> > git tree: linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x\x11880d69600000
> > kernel config: https://syzkaller.appspot.com/x/.config?x\x110691c2286b679a
> > dashboard link: https://syzkaller.appspot.com/bug?extidë853b51b10f1befa0b7
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x\x127c3481600000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x\x1150a70d600000
> >
> > The bug was bisected to:
> >
> > commit 2f4fa2db75e26995709043c8d3de4632ebed5c4b
> > Author: Al Viro <viro@zeniv.linux.org.uk>
> > Date: Thu Apr 18 03:48:01 2019 +0000
> >
> > compat_ioctl: unify copy-in of ppp filters
> >
> > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x\x145eee1d600000
> > final crash: https://syzkaller.appspot.com/x/report.txt?x\x165eee1d600000
> > console output: https://syzkaller.appspot.com/x/log.txt?x\x125eee1d600000
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+eb853b51b10f1befa0b7@syzkaller.appspotmail.com
> > Fixes: 2f4fa2db75e2 ("compat_ioctl: unify copy-in of ppp filters")
> >
> > =================================
> > BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:404 [inline]
> > BUG: KASAN: slab-out-of-bounds in bpf_prog_create+0xe9/0x250
> > net/core/filter.c:1351
> > Read of size 32768 at addr ffff88809cf74000 by task syz-executor183/8575
> >
> > CPU: 0 PID: 8575 Comm: syz-executor183 Not tainted 5.3.0-rc8-next-20190915
> > #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > Google 01/01/2011
> > Call Trace:
> > __dump_stack lib/dump_stack.c:77 [inline]
> > dump_stack+0x172/0x1f0 lib/dump_stack.c:113
> > print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
> > __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
> > kasan_report+0x12/0x20 mm/kasan/common.c:634
> > check_memory_region_inline mm/kasan/generic.c:185 [inline]
> > check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192
> > memcpy+0x24/0x50 mm/kasan/common.c:122
> > memcpy include/linux/string.h:404 [inline]
> > bpf_prog_create+0xe9/0x250 net/core/filter.c:1351
> > get_filter.isra.0+0x108/0x1a0 drivers/net/ppp/ppp_generic.c:572
> > ppp_get_filter drivers/net/ppp/ppp_generic.c:584 [inline]
> > ppp_ioctl+0x129d/0x2590 drivers/net/ppp/ppp_generic.c:801
>
> This is a correct bisection. This commit needs:
>
> diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
> index 267fe2c58087..f55d7937d6c5 100644
> --- a/drivers/net/ppp/ppp_generic.c
> +++ b/drivers/net/ppp/ppp_generic.c
> @@ -564,8 +564,9 @@ static struct bpf_prog *get_filter(struct sock_fprog *uprog)
> return NULL;
>
> /* uprog->len is unsigned short, so no overflow here */
> - fprog.len = uprog->len * sizeof(struct sock_filter);
> - fprog.filter = memdup_user(uprog->filter, fprog.len);
> + fprog.len = uprog->len;
> + fprog.filter = memdup_user(uprog->filter,
> + uprog->len * sizeof(struct sock_filter));
> if (IS_ERR(fprog.filter))
> return ERR_CAST(fprog.filter);
>
Why did you ignore this and merge the buggy commit to mainline anyway?
I even told you how to fix it...
- Eric
next prev parent reply other threads:[~2019-12-05 5:22 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-17 18:49 KASAN: slab-out-of-bounds Read in bpf_prog_create syzbot
2019-09-17 18:49 ` syzbot
2019-09-28 3:15 ` Eric Biggers
2019-09-28 3:15 ` Eric Biggers
2019-12-05 5:22 ` Eric Biggers [this message]
2019-12-05 5:22 ` Eric Biggers
2019-12-05 5:54 ` [PATCH] ppp: fix out-of-bounds access in bpf_prog_create() Eric Biggers
2019-12-05 5:54 ` Eric Biggers
2019-12-05 9:07 ` Arnd Bergmann
2019-12-05 9:07 ` Arnd Bergmann
2019-12-05 22:45 ` David Miller
2019-12-05 22:45 ` David Miller
2019-12-05 9:08 ` KASAN: slab-out-of-bounds Read in bpf_prog_create Arnd Bergmann
2019-12-05 9:08 ` Arnd Bergmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191205052220.GC1158@sol.localdomain \
--to=ebiggers@kernel.org \
--cc=arnd@arndb.de \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=hawk@kernel.org \
--cc=jakub.kicinski@netronome.com \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-ppp@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=paulus@samba.org \
--cc=songliubraving@fb.com \
--cc=syzbot+eb853b51b10f1befa0b7@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.