* [syzbot] [net?] KASAN: global-out-of-bounds Read in __nla_validate_parse
@ 2024-04-08 5:37 syzbot
2024-04-08 5:40 ` Eric Dumazet
2024-04-09 9:41 ` [syzbot] Re: [PATCH net-next] net: team: fix incorrect maxattr syzbot
0 siblings, 2 replies; 5+ messages in thread
From: syzbot @ 2024-04-08 5:37 UTC (permalink / raw)
To: davem, edumazet, kuba, linux-kernel, netdev, pabeni, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 8568bb2ccc27 Add linux-next specific files for 20240405
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16446339180000
kernel config: https://syzkaller.appspot.com/x/.config?x=48ca5acf8d2eb3bc
dashboard link: https://syzkaller.appspot.com/bug?extid=ecd7e07b4be038658c9f
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=134f60bd180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1043b303180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1d120b5e779c/disk-8568bb2c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a89e3589a585/vmlinux-8568bb2c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/045e657c0e0d/bzImage-8568bb2c.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ecd7e07b4be038658c9f@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:411 [inline]
BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x1f1c/0x2f70 lib/nlattr.c:635
Read of size 1 at addr ffffffff8c55d030 by task syz-executor361/5080
CPU: 1 PID: 5080 Comm: syz-executor361 Not tainted 6.9.0-rc2-next-20240405-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
validate_nla lib/nlattr.c:411 [inline]
__nla_validate_parse+0x1f1c/0x2f70 lib/nlattr.c:635
__nla_parse+0x40/0x60 lib/nlattr.c:732
__nlmsg_parse include/net/netlink.h:760 [inline]
genl_family_rcv_msg_attrs_parse+0x1d1/0x290 net/netlink/genetlink.c:945
genl_family_rcv_msg_doit net/netlink/genetlink.c:1093 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x802/0xec0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2559
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x8e1/0xcb0 net/netlink/af_netlink.c:1905
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
___sys_sendmsg net/socket.c:2638 [inline]
__sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
do_syscall_64+0xfb/0x240
entry_SYSCALL_64_after_hwframe+0x72/0x7a
RIP: 0033:0x7f831a5c23a9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcd752ec88 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ffcd752ee58 RCX: 00007f831a5c23a9
RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 00007f831a635610 R08: 00007f831a5fda23 R09: 00007ffcd752ee58
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffcd752ee48 R14: 0000000000000001 R15: 0000000000000001
</TASK>
The buggy address belongs to the variable:
team_nl_policy+0x30/0x60
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xc55d
flags: 0xfff80000002000(reserved|node=0|zone=1|lastcpupid=0xfff)
raw: 00fff80000002000 ffffea0000315748 ffffea0000315748 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffffff8c55cf00: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
ffffffff8c55cf80: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9
>ffffffff8c55d000: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
^
ffffffff8c55d080: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
ffffffff8c55d100: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 02 f9 f9
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [net?] KASAN: global-out-of-bounds Read in __nla_validate_parse
2024-04-08 5:37 [syzbot] [net?] KASAN: global-out-of-bounds Read in __nla_validate_parse syzbot
@ 2024-04-08 5:40 ` Eric Dumazet
2024-04-08 9:15 ` Hangbin Liu
2024-04-09 9:41 ` [syzbot] Re: [PATCH net-next] net: team: fix incorrect maxattr syzbot
1 sibling, 1 reply; 5+ messages in thread
From: Eric Dumazet @ 2024-04-08 5:40 UTC (permalink / raw)
To: syzbot, Hangbin Liu
Cc: davem, kuba, linux-kernel, netdev, pabeni, syzkaller-bugs
On Mon, Apr 8, 2024 at 7:37 AM syzbot
<syzbot+ecd7e07b4be038658c9f@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 8568bb2ccc27 Add linux-next specific files for 20240405
> git tree: linux-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=16446339180000
> kernel config: https://syzkaller.appspot.com/x/.config?x=48ca5acf8d2eb3bc
> dashboard link: https://syzkaller.appspot.com/bug?extid=ecd7e07b4be038658c9f
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=134f60bd180000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1043b303180000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/1d120b5e779c/disk-8568bb2c.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/a89e3589a585/vmlinux-8568bb2c.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/045e657c0e0d/bzImage-8568bb2c.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+ecd7e07b4be038658c9f@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:411 [inline]
> BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x1f1c/0x2f70 lib/nlattr.c:635
> Read of size 1 at addr ffffffff8c55d030 by task syz-executor361/5080
>
> CPU: 1 PID: 5080 Comm: syz-executor361 Not tainted 6.9.0-rc2-next-20240405-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
> print_address_description mm/kasan/report.c:377 [inline]
> print_report+0x169/0x550 mm/kasan/report.c:488
> kasan_report+0x143/0x180 mm/kasan/report.c:601
> validate_nla lib/nlattr.c:411 [inline]
> __nla_validate_parse+0x1f1c/0x2f70 lib/nlattr.c:635
> __nla_parse+0x40/0x60 lib/nlattr.c:732
> __nlmsg_parse include/net/netlink.h:760 [inline]
> genl_family_rcv_msg_attrs_parse+0x1d1/0x290 net/netlink/genetlink.c:945
> genl_family_rcv_msg_doit net/netlink/genetlink.c:1093 [inline]
> genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
> genl_rcv_msg+0x802/0xec0 net/netlink/genetlink.c:1210
> netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2559
> genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
> netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
> netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1361
> netlink_sendmsg+0x8e1/0xcb0 net/netlink/af_netlink.c:1905
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x221/0x270 net/socket.c:745
> ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
> ___sys_sendmsg net/socket.c:2638 [inline]
> __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
> do_syscall_64+0xfb/0x240
> entry_SYSCALL_64_after_hwframe+0x72/0x7a
> RIP: 0033:0x7f831a5c23a9
> Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffcd752ec88 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 00007ffcd752ee58 RCX: 00007f831a5c23a9
> RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
> RBP: 00007f831a635610 R08: 00007f831a5fda23 R09: 00007ffcd752ee58
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
> R13: 00007ffcd752ee48 R14: 0000000000000001 R15: 0000000000000001
> </TASK>
>
> The buggy address belongs to the variable:
> team_nl_policy+0x30/0x60
>
> The buggy address belongs to the physical page:
> page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xc55d
> flags: 0xfff80000002000(reserved|node=0|zone=1|lastcpupid=0xfff)
> raw: 00fff80000002000 ffffea0000315748 ffffea0000315748 0000000000000000
> raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
> page dumped because: kasan: bad access detected
> page_owner info is not present (never set?)
>
> Memory state around the buggy address:
> ffffffff8c55cf00: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
> ffffffff8c55cf80: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9
> >ffffffff8c55d000: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
> ^
> ffffffff8c55d080: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
> ffffffff8c55d100: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 02 f9 f9
> ==================================================================
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
Probably caused by
commit 948dbafc15da900b13c2bc9e244b9e109303907b
Author: Hangbin Liu <liuhangbin@gmail.com>
Date: Mon Apr 1 11:10:03 2024 +0800
net: team: use policy generated by YAML spec
generated with:
$ ./tools/net/ynl/ynl-gen-c.py --mode kernel \
> --spec Documentation/netlink/specs/team.yaml --source \
> -o drivers/net/team/team_nl.c
$ ./tools/net/ynl/ynl-gen-c.py --mode kernel \
> --spec Documentation/netlink/specs/team.yaml --header \
> -o drivers/net/team/team_nl.h
The TEAM_ATTR_LIST_PORT in team_nl_policy is removed as it is only in the
port list reply attributes.
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20240401031004.1159713-4-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [net?] KASAN: global-out-of-bounds Read in __nla_validate_parse
2024-04-08 5:40 ` Eric Dumazet
@ 2024-04-08 9:15 ` Hangbin Liu
2024-04-09 1:27 ` Jakub Kicinski
0 siblings, 1 reply; 5+ messages in thread
From: Hangbin Liu @ 2024-04-08 9:15 UTC (permalink / raw)
To: Eric Dumazet
Cc: syzbot, davem, kuba, linux-kernel, netdev, pabeni, syzkaller-bugs
On Mon, Apr 08, 2024 at 07:40:00AM +0200, Eric Dumazet wrote:
> Probably caused by
>
> commit 948dbafc15da900b13c2bc9e244b9e109303907b
> Author: Hangbin Liu <liuhangbin@gmail.com>
> Date: Mon Apr 1 11:10:03 2024 +0800
>
> net: team: use policy generated by YAML spec
>
> generated with:
>
> $ ./tools/net/ynl/ynl-gen-c.py --mode kernel \
> > --spec Documentation/netlink/specs/team.yaml --source \
> > -o drivers/net/team/team_nl.c
> $ ./tools/net/ynl/ynl-gen-c.py --mode kernel \
> > --spec Documentation/netlink/specs/team.yaml --header \
> > -o drivers/net/team/team_nl.h
>
> The TEAM_ATTR_LIST_PORT in team_nl_policy is removed as it is only in the
> port list reply attributes.
>
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
> Reviewed-by: Jiri Pirko <jiri@nvidia.com>
> Link: https://lore.kernel.org/r/20240401031004.1159713-4-liuhangbin@gmail.com
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Thanks for the report, I will check what I missed.
Hangbin
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [net?] KASAN: global-out-of-bounds Read in __nla_validate_parse
2024-04-08 9:15 ` Hangbin Liu
@ 2024-04-09 1:27 ` Jakub Kicinski
0 siblings, 0 replies; 5+ messages in thread
From: Jakub Kicinski @ 2024-04-09 1:27 UTC (permalink / raw)
To: Hangbin Liu
Cc: Eric Dumazet, syzbot, davem, linux-kernel, netdev, pabeni,
syzkaller-bugs
On Mon, 8 Apr 2024 17:15:07 +0800 Hangbin Liu wrote:
> Thanks for the report, I will check what I missed.
.maxattr = ARRAY_SIZE(team_nl_policy),
needs "- 1"
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] Re: [PATCH net-next] net: team: fix incorrect maxattr
2024-04-08 5:37 [syzbot] [net?] KASAN: global-out-of-bounds Read in __nla_validate_parse syzbot
2024-04-08 5:40 ` Eric Dumazet
@ 2024-04-09 9:41 ` syzbot
1 sibling, 0 replies; 5+ messages in thread
From: syzbot @ 2024-04-09 9:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH net-next] net: team: fix incorrect maxattr
Author: liuhangbin@gmail.com
On Tue, Apr 09, 2024 at 05:28:12PM +0800, Hangbin Liu wrote:
> The maxattr should be the latest attr value, i.e. array size - 1,
> not total array size.
>
> Reported-by: syzbot+ecd7e07b4be038658c9f@syzkaller.appspotmail.com
> Fixes: 948dbafc15da ("net: team: use policy generated by YAML spec")
> Suggested-by: Jakub Kicinski <kuba@kernel.org>
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
> ---
> drivers/net/team/team_core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
> index 4e3c8d404957..8c7dbaf7c22e 100644
> --- a/drivers/net/team/team_core.c
> +++ b/drivers/net/team/team_core.c
> @@ -2808,7 +2808,7 @@ static const struct genl_multicast_group team_nl_mcgrps[] = {
> static struct genl_family team_nl_family __ro_after_init = {
> .name = TEAM_GENL_NAME,
> .version = TEAM_GENL_VERSION,
> - .maxattr = ARRAY_SIZE(team_nl_policy),
> + .maxattr = ARRAY_SIZE(team_nl_policy) - 1,
> .policy = team_nl_policy,
> .netnsok = true,
> .module = THIS_MODULE,
> --
> 2.43.0
>
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git main
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-04-09 9:41 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-04-08 5:37 [syzbot] [net?] KASAN: global-out-of-bounds Read in __nla_validate_parse syzbot
2024-04-08 5:40 ` Eric Dumazet
2024-04-08 9:15 ` Hangbin Liu
2024-04-09 1:27 ` Jakub Kicinski
2024-04-09 9:41 ` [syzbot] Re: [PATCH net-next] net: team: fix incorrect maxattr syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.