Re: LIBBPF Bugs

Re: LIBBPF Bugs

[Andrii Nakryiko]

On Fri, Mar 6, 2020 at 1:50 AM Benjamin Nilsen <bcnilsen@ucdavis.edu> wrote:
>
> Hello,
>
> Here is a follow up to the previous email with a more in-depth look at the bugs.  I should have some more in the following days that detail the bugs found earlier and some new ones as well.
>
> Attached is a C class and some binary files to trigger the corresponding bugs.
> (These methods may be called in an unconventional way as I designed it with a fuzzer in mind).
>
> The terminal output should be useful in tracing the bug.
>
> To run, compile C program and run: ./executable id:000000
>
>
> Regards,
> Ben
>

Thanks Benjamin!

Eric, you seem to have done most work on netlink-related parts of
libbpf. Do you mind taking a look at these bug reports?

> Bug 1: error with libbpf_nla_dump_errormsg()
> The binary file: "id:000000" causes this crash.
>
> From terminal:
>
> Calling libbpf_nla_dump_errormsg
>
>
> Value of nla_len = 13619
>
> AddressSanitizer:DEADLYSIGNAL
>
> =================================================================
>
> ==28356==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe555d74c0 (pc 0x55f1f9765b38 bp 0x7f20ebfb6c24 sp 0x7ffe555d3da0 T0)
>
>     #0 0x55f1f9765b37 in nla_ok /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c
>
>     #1 0x55f1f9765b37 in libbpf_nla_parse /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:112
>
>     #2 0x55f1f97674df in libbpf_nla_dump_errormsg /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:183:6
>
>     #3 0x55f1f9767c82 in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:249:1
>
>     #4 0x7f20eabddb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
>
>     #5 0x55f1f96332d9 in _start (/home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.fast+0x272d9)
>
>
> SUMMARY: AddressSanitizer: stack-overflow /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c in nla_ok
>
> ==28356==ABORTING
>
>
>
>
>
>
>
> Bug 2: error with libbpf_nla_parse_nested()
>
> The binary file "id:000001" causes this crash.
>
>
> From Terminal:
>
> libbpf_nla_parse_nested
>
> =================================================================
>
> ==51153==ERROR: AddressSanitizer: negative-size-param: (size=-2952410560)
>
>     #0 0x563779c9bdf1 in __asan_memset /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:27:3
>
>     #1 0x563779d274ea in libbpf_nla_parse /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:110:2
>
>     #2 0x563779d29d2a in libbpf_nla_parse_nested /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:153:9
>
>     #3 0x563779d29d2a in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:253
>
>     #4 0x7f85e283fb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
>
>     #5 0x563779bf52d9 in _start (/home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.fast+0x272d9)
>
>
> Address 0x7ffe120ab478 is located in stack of thread T0 at offset 56 in frame
>
>
>
>
> Bug 3: error with libbpf_nla_dump_errormsg()
> The binary file "id:000003" causes this crash.
>
> From Terminal:
>
> Calling libbpf_nla_dump_errormsg
>
>
> AddressSanitizer:DEADLYSIGNAL
>
> =================================================================
>
> ==31841==ERROR: AddressSanitizer: SEGV on unknown address 0x7ffe6a8e1e51 (pc 0x55e81517d505 bp 0x7ffe083b3e80 sp 0x7ffe083b3dc0 T0)
>
> ==31841==The signal is caused by a READ memory access.
>
>     #0 0x55e81517d504 in nla_ok /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c
>
>     #1 0x55e81517d504 in libbpf_nla_parse /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:112
>
>     #2 0x55e81517f4df in libbpf_nla_dump_errormsg /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:183:6
>
>     #3 0x55e81517fc82 in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:249:1
>
>     #4 0x7f887b165b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
>
>     #5 0x55e81504b2d9 in _start (/home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.fast+0x272d9)
>
>
> AddressSanitizer can not provide additional info.
>
> SUMMARY: AddressSanitizer: SEGV /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c in nla_ok
>
> ==31841==ABORTING
>
>
>
>
> Bug 4: error with libbpf_nla_parse_nested()
> The binary file "id:000004" causes this crash.
>
> From Terminal:
>
> Calling libbpf_nla_dump_errormsg
>
>
> Value of nla_len = 1
>
> Kernel error message: (null)
>
> libbpf_nla_parse_nested
>
> =================================================================
>
> ==5753==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffb86702f8 at pc 0x55f5e071fedf bp 0x7fffb8670230 sp 0x7fffb866f9e0
>
> WRITE of size 206576 at 0x7fffb86702f8 thread T0
>
>     #0 0x55f5e071fede in __asan_memset /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:27:3
>
>     #1 0x55f5e07ab4ea in libbpf_nla_parse /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:110:2
>
>     #2 0x55f5e07add2a in libbpf_nla_parse_nested /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:153:9
>
>     #3 0x55f5e07add2a in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:253
>
>     #4 0x7f634d278b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
>
>     #5 0x55f5e06792d9 in _start (/home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.fast+0x272d9)
>
>
> Address 0x7fffb86702f8 is located in stack of thread T0 at offset 88 in frame
>
>     #0 0x55f5e07ad9ff in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:200
>
>
>   This frame has 1 object(s):
>
>     [32, 88) 'pta' (line 219) <== Memory access at offset 88 overflows this variable
>
> HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
>
>       (longjmp and C++ exceptions *are* supported)
>
> SUMMARY: AddressSanitizer: stack-buffer-overflow /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:27:3 in __asan_memset
>
> Shadow bytes around the buggy address:
>
>   0x1000770c6000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>
>   0x1000770c6010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>
>   0x1000770c6020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>
>   0x1000770c6030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>
>   0x1000770c6040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>
> =>0x1000770c6050: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00[f3]
>
>   0x1000770c6060: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
>
>   0x1000770c6070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>
>   0x1000770c6080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>
>   0x1000770c6090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>
>   0x1000770c60a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>
>
>
>
>
>
> Bug 5:
> The binary file "id:000006" causes this crash.
>
> From Terminal:
>
> Calling libbpf_nla_dump_errormsg
>
>
> Value of nla_len = 64
>
> Value of nla_len = 32765
>
> Attribute of type 0 found multiple times in message, previous attribute is being ignored.
>
> AddressSanitizer:DEADLYSIGNAL
>
> =================================================================
>
> ==55647==ERROR: AddressSanitizer: stack-overflow on address 0x7ffdf2ecd6cc (pc 0x55f55cc87b38 bp 0x7fc57936bc24 sp 0x7ffdf2ec54a0 T0)
>
>     #0 0x55f55cc87b37 in nla_ok /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c
>
>     #1 0x55f55cc87b37 in libbpf_nla_parse /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:112
>
>     #2 0x55f55cc894df in libbpf_nla_dump_errormsg /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:183:6
>
>     #3 0x55f55cc89c82 in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:249:1
>
>     #4 0x7fc577f92b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
>
>     #5 0x55f55cb552d9 in _start (/home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.fast+0x272d9)
>
>
>
> Bug 6: error with libbpf_nla_parse()
> The binary file "id:000009" causes this crash.
>
> From Terminal:
>
> Calling libbpf_nla_dump_errormsg
>
>
> libbpf_nla_parse_nested
>
> Value of nla_len = 64052
>
> libbpf_nla_parse
>
> Value of nla_len = 13619
>
> AddressSanitizer:DEADLYSIGNAL
>
> =================================================================
>
> ==45753==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd12cc54fe (pc 0x556d02baeb38 bp 0x7f80f4a19c24 sp 0x7ffd12cc1f20 T0)
>
>     #0 0x556d02baeb37 in nla_ok /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c
>
>     #1 0x556d02baeb37 in libbpf_nla_parse /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:112
>
>     #2 0x556d02bb0da9 in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:257:1
>
>     #3 0x7f80f3640b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
>
>     #4 0x556d02a7c2d9 in _start (/home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.fast+0x272d9)
>
>
>
> Bug 7:
>
> The binary file "id:000014" causes this crash.
>
>
> From Terminal:
>
> Calling libbpf_nla_dump_errormsg
>
>
> Value of nla_len = 51253
>
> Kernel error message: (null)
>
> libbpf_nla_parse_nested
>
> =================================================================
>
> ==56762==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd9f8521b8 at pc 0x55585aa85edf bp 0x7ffd9f8520f0 sp 0x7ffd9f8518a0
>
> WRITE of size 224 at 0x7ffd9f8521b8 thread T0
>
>     #0 0x55585aa85ede in __asan_memset /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:27:3
>
>     #1 0x55585ab114ea in libbpf_nla_parse /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:110:2
>
>     #2 0x55585ab13d2a in libbpf_nla_parse_nested /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:153:9
>
>     #3 0x55585ab13d2a in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:253
>
>     #4 0x7f5b104b9b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
>
>     #5 0x55585a9df2d9 in _start (/home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.fast+0x272d9)
>
>
> Address 0x7ffd9f8521b8 is located in stack of thread T0 at offset 88 in frame
>
>     #0 0x55585ab139ff in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:200
>
>
>   This frame has 1 object(s):
>
>     [32, 88) 'pta' (line 219) <== Memory access at offset 88 overflows this variable
>
>
>
>
> Bug 8: Error with validate_nla
> The binary file "id:000019" causes this crash.
>
> From Terminal:
>
> Calling libbpf_nla_dump_errormsg
>
>
> Value of nla_len = 0
>
> Kernel error message: (null)
>
> libbpf_nla_parse_nested
>
> Value of nla_len = 54375
>
> libbpf_nla_parse
>
> Value of nla_len = 2758
>
> Value of nla_len = 0
>
> validate_nla
>
> AddressSanitizer:DEADLYSIGNAL
>
> =================================================================
>
> ==16614==ERROR: AddressSanitizer: stack-overflow on address 0x7ffddbaa8ac2 (pc 0x55af14a70660 bp 0x7fee9b192c24 sp 0x7ffddba98c70 T0)
>
>     #0 0x55af14a7065f in validate_nla /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:57:10
>
>     #1 0x55af14a71dfb in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:261:1
>
>     #2 0x7fee99db9b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
>
>     #3 0x55af1493d2d9 in _start (/home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.fast+0x272d9)
>
>
> SUMMARY: AddressSanitizer: stack-overflow /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:57:10 in validate_nla
>
> ==16614==ABORTING
>
>
>
> Bug 9:
>
> The binary file "id:000023" causes this crash.
>
> From Terminal:
>
> Calling libbpf_nla_dump_errormsg
>
>
> Value of nla_len = 1519
>
> Value of nla_len = 0
>
> Kernel error message:
>
> libbpf_nla_parse_nested
>
> =================================================================
>
> ==78237==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffed48f3398 at pc 0x55e8e9a61edf bp 0x7ffed48f32d0 sp 0x7ffed48f2a80
>
> WRITE of size 30033832 at 0x7ffed48f3398 thread T0
>
>     #0 0x55e8e9a61ede in __asan_memset /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:27:3
>
>     #1 0x55e8e9aed4ea in libbpf_nla_parse /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:110:2
>
>     #2 0x55e8e9aefd2a in libbpf_nla_parse_nested /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:153:9
>
>     #3 0x55e8e9aefd2a in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:253
>
>     #4 0x7f593cf0eb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
>
>     #5 0x55e8e99bb2d9 in _start (/home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.fast+0x272d9)
>
>
> Address 0x7ffed48f3398 is located in stack of thread T0 at offset 88 in frame
>
>     #0 0x55e8e9aef9ff in main /home/bcnilsen/bcc/src/cc/libbpf/srcRemote/nlattrFuzz.c:200
>
>
>   This frame has 1 object(s):
>
>     [32, 88) 'pta' (line 219) <== Memory access at offset 88 overflows this variable
>
>
>
>
>