From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752371AbbK3D3J (ORCPT ); Sun, 29 Nov 2015 22:29:09 -0500 Received: from mail-pa0-f43.google.com ([209.85.220.43]:33391 "EHLO mail-pa0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751660AbbK3D3G (ORCPT ); Sun, 29 Nov 2015 22:29:06 -0500 Message-ID: <1448854142.24696.109.camel@edumazet-glaptop2.roam.corp.google.com> Subject: Re: use-after-free in ip6_setup_cork From: Eric Dumazet To: Dmitry Vyukov Cc: Vlad Yasevich , "David S. Miller" , Alexey Kuznetsov , James Morris , Hideaki YOSHIFUJI , Patrick McHardy , netdev , LKML , Eric Dumazet , William Dauchy , Rainer Weikusat , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin Date: Sun, 29 Nov 2015 19:29:02 -0800 In-Reply-To: <1448731434.24696.97.camel@edumazet-glaptop2.roam.corp.google.com> References: <1448730683.24696.94.camel@edumazet-glaptop2.roam.corp.google.com> <1448731434.24696.97.camel@edumazet-glaptop2.roam.corp.google.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, 2015-11-28 at 09:23 -0800, Eric Dumazet wrote: > On Sat, 2015-11-28 at 09:11 -0800, Eric Dumazet wrote: > > On Sat, 2015-11-28 at 12:00 +0100, Dmitry Vyukov wrote: > > > Hello, > > > > > > The following program triggers use-after-free in ip6_setup_cork: > > > > > > // autogenerated by syzkaller (http://github.com/google/syzkaller) > > > #include > > > #include > > > #include > > > #include > > > > > > int r1, r3, r4; > > > > > > void *thr0(void *arg) > > > { > > > *(uint64_t*)0x20000d90 = 0x20000fd3; > > > *(uint64_t*)0x20000d98 = 0x2d; > > > *(uint64_t*)0x20000da0 = 0x20000fa4; > > > *(uint64_t*)0x20000da8 = 0x5c; > > > *(uint64_t*)0x20000db0 = 0x20000fac; > > > *(uint64_t*)0x20000db8 = 0x71; > > > *(uint64_t*)0x20000dc0 = 0x20000fb6; > > > *(uint64_t*)0x20000dc8 = 0xec; > > > *(uint64_t*)0x20000dd0 = 0x20000fae; > > > *(uint64_t*)0x20000dd8 = 0x70; > > > syscall(SYS_vmsplice, r4, 0x20000d90ul, 0x5ul, 0x2ul, 0, 0); > > > return 0; > > > } > > > > > > void *thr1(void *arg) > > > { > > > memcpy((void*)0x200025e5, "\xbb\xef\x44\xd6\x33\x93", 6); > > > syscall(SYS_setsockopt, r1, 0x29ul, 0x6ul, 0x200025e5ul, 0x6ul, 0); > > > return 0; > > > } > > > > > > void *thr2(void *arg) > > > { > > > syscall(SYS_splice, r3, 0x0ul, r1, 0x0ul, 0xaful, 0x3ul); > > > return 0; > > > } > > > > > > int main() > > > { > > > syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, 0x32ul, > > > 0xfffffffffffffffful, 0x0ul); > > > r1 = syscall(SYS_socket, 0xaul, 0x80002ul, 0x0ul, 0, 0, 0); > > > syscall(SYS_pipe2, 0x20001000ul, 0x800ul, 0, 0, 0, 0); > > > r3 = *(uint32_t*)0x20001000; > > > r4 = *(uint32_t*)0x20001004; > > > memcpy((void*)0x20003000, > > > "\x0a\x00\x33\xe2\x61\x44\xfe\x90\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x5b\x11\x6d\x22", > > > 28); > > > long r6 = syscall(SYS_connect, r1, 0x20003000ul, 0x1cul, 0, 0, 0); > > > pthread_t th[4]; > > > pthread_create(&th[0], 0, thr0, 0); > > > pthread_create(&th[1], 0, thr1, 0); > > > pthread_create(&th[2], 0, thr2, 0); > > > pthread_create(&th[3], 0, thr1, 0); > > > pthread_join(th[0], 0); > > > pthread_join(th[1], 0); > > > pthread_join(th[2], 0); > > > pthread_join(th[3], 0); > > > return 0; > > > } > > > > > > > > > ================================================================== > > > BUG: KASAN: use-after-free in ip6_setup_cork+0xeb8/0x11a0 at addr > > > ffff88006d36da08 > > > Read of size 4 by task executor/23958 > > > ============================================================================= > > > BUG kmalloc-64 (Not tainted): kasan: bad access detected > > > ----------------------------------------------------------------------------- > > > > > > Disabling lock debugging due to kernel taint > > > INFO: Allocated in sock_kmalloc+0x7f/0xc0 age=9 cpu=3 pid=23946 > > > [< none >] ___slab_alloc+0x41c/0x460 mm/slub.c:2438 > > > [< none >] __slab_alloc+0x1b/0x30 mm/slub.c:2467 > > > [< inline >] slab_alloc_node mm/slub.c:2530 > > > [< inline >] slab_alloc mm/slub.c:2572 > > > [< none >] __kmalloc+0x156/0x1b0 mm/slub.c:3532 > > > [< inline >] kmalloc include/linux/slab.h:463 > > > [< none >] sock_kmalloc+0x7f/0xc0 net/core/sock.c:1774 > > > [< none >] do_ipv6_setsockopt.isra.8+0x779/0x2a60 > > > net/ipv6/ipv6_sockglue.c:483 > > > [< none >] ipv6_setsockopt+0x9b/0x140 net/ipv6/ipv6_sockglue.c:885 > > > [< none >] udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1425 > > > [< none >] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2645 > > > [< inline >] SYSC_setsockopt net/socket.c:1757 > > > [< none >] SyS_setsockopt+0x158/0x240 net/socket.c:1736 > > > [< none >] entry_SYSCALL_64_fastpath+0x12/0x71 > > > arch/x86/entry/entry_64.S:185 > > > > > > INFO: Freed in sock_kfree_s+0x29/0x70 age=11 cpu=2 pid=23957 > > > [< none >] __slab_free+0x1fb/0x300 mm/slub.c:2648 > > > [< inline >] slab_free mm/slub.c:2803 > > > [< none >] kfree+0x13b/0x160 mm/slub.c:3632 > > > [< inline >] __sock_kfree_s net/core/sock.c:1795 > > > [< none >] sock_kfree_s+0x29/0x70 net/core/sock.c:1801 > > > [< none >] do_ipv6_setsockopt.isra.8+0x815/0x2a60 > > > net/ipv6/ipv6_sockglue.c:506 > > > [< none >] ipv6_setsockopt+0x9b/0x140 net/ipv6/ipv6_sockglue.c:885 > > > [< none >] udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1425 > > > [< none >] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2645 > > > [< inline >] SYSC_setsockopt net/socket.c:1757 > > > [< none >] SyS_setsockopt+0x158/0x240 net/socket.c:1736 > > > [< none >] entry_SYSCALL_64_fastpath+0x12/0x71 > > > arch/x86/entry/entry_64.S:185 > > > > > > INFO: Slab 0xffffea0001b4db00 objects=20 used=8 fp=0xffff88006d36da08 > > > flags=0x500000000004080 > > > INFO: Object 0xffff88006d36da08 @offset=6664 fp=0xffff88006d36d3e8 > > > CPU: 3 PID: 23958 Comm: executor Tainted: G B 4.4.0-rc2+ #1 > > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > > > 00000000ffffffff ffff88003c32f348 ffffffff81a2bdb0 ffff88003e807840 > > > ffff88006d36da08 ffff88006d36c000 ffff88003c32f378 ffffffff814541d4 > > > ffff88003e807840 ffffea0001b4db00 ffff88006d36da08 ffff88006d126000 > > > > > > Call Trace: > > > [] __asan_report_load4_noabort+0x3e/0x40 > > > mm/kasan/report.c:279 > > > [] ip6_setup_cork+0xeb8/0x11a0 net/ipv6/ip6_output.c:1200 > > > [] ip6_make_skb+0x19a/0x3b0 net/ipv6/ip6_output.c:1769 > > > [] udpv6_sendmsg+0x11c6/0x2120 net/ipv6/udp.c:1314 > > > [] inet_sendmsg+0x23c/0x340 net/ipv4/af_inet.c:733 > > > [< inline >] sock_sendmsg_nosec net/socket.c:610 > > > [] sock_sendmsg+0xca/0x110 net/socket.c:620 > > > [] kernel_sendmsg+0x47/0x60 net/socket.c:628 > > > [] sock_no_sendpage+0xfa/0x130 net/core/sock.c:2270 > > > [] kernel_sendpage+0x90/0xe0 net/socket.c:3278 > > > [] sock_sendpage+0xa5/0xd0 net/socket.c:765 > > > [] pipe_to_sendpage+0x264/0x320 fs/splice.c:720 > > > [< inline >] splice_from_pipe_feed fs/splice.c:772 > > > [] __splice_from_pipe+0x235/0x6d0 fs/splice.c:897 > > > [] splice_from_pipe+0xf7/0x140 fs/splice.c:932 > > > [] generic_splice_sendpage+0x40/0x50 fs/splice.c:1105 > > > [< inline >] do_splice_from fs/splice.c:1124 > > > [< inline >] do_splice fs/splice.c:1400 > > > [< inline >] SYSC_splice fs/splice.c:1703 > > > [] SyS_splice+0x7c8/0x15c0 fs/splice.c:1686 > > > [] entry_SYSCALL_64_fastpath+0x12/0x71 > > > arch/x86/entry/entry_64.S:185 > > > ================================================================== > > > > > > > > > On commit 78c4a49a69e910a162b05e4e8727b9bdbf948f13 (Nov 25). > > > -- > > > > Thanks for the report. > > > > Bug probably added in : > > > > commit 03485f2adcde0c2d4e9228b659be78e872486bbb > > Author: Vlad Yasevich > > Date: Sat Jan 31 10:40:17 2015 -0500 > > > > udpv6: Add lockless sendmsg() support > > > > This commit adds the same functionaliy to IPv6 that > > commit 903ab86d195cca295379699299c5fc10beba31c7 > > Author: Herbert Xu > > Date: Tue Mar 1 02:36:48 2011 +0000 > > > > udp: Add lockless transmit path > > > > added to IPv4. > > > > UDP transmit path can now run without a socket lock, > > thus allowing multiple threads to send to a single socket > > more efficiently. > > This is only used when corking/MSG_MORE is not used. > > > > Signed-off-by: Vladislav Yasevich > > Signed-off-by: David S. Miller > > > > > > Oh well, bug is older than that. > > inet6_sk(sk)->opt handling is completely racy, and has some xchg() calls > to hide how ugly it is. I have a patch that looks ready for submission. While testing it, I also saw a problem in ipv6_update_options(), calling sk_dst_reset() which directly conflicts with ip6_dst_store() (ip6_dst_store() uses spin_lock(&sk->sk_dst_lock), which basically protects councurrent ip6_dst_store() ... :( )