linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* A slab-out-of-bounds Read bug in __htab_map_lookup_and_delete_batch
@ 2021-12-29 10:10 butt3rflyh4ck
  2021-12-30  2:23 ` Alexei Starovoitov
  0 siblings, 1 reply; 9+ messages in thread
From: butt3rflyh4ck @ 2021-12-29 10:10 UTC (permalink / raw)
  To: ast, daniel, andrii, kafai, songliubraving, yhs, john.fastabend, kpsingh
  Cc: Networking, bpf, LKML

Hi, there is a slab-out-bounds Read bug in
__htab_map_lookup_and_delete_batch in kernel/bpf/hashtab.c
and I reproduce it in linux-5.16.rc7(upstream) and latest linux-5.15.11.

#carsh log
[  166.945208][ T6897]
==================================================================
[  166.947075][ T6897] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x87/0xb0
[  166.948612][ T6897] Read of size 49 at addr ffff88801913f800 by
task __htab_map_look/6897
[  166.950406][ T6897]
[  166.950890][ T6897] CPU: 1 PID: 6897 Comm: __htab_map_look Not
tainted 5.16.0-rc7+ #30
[  166.952521][ T6897] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.13.0-1ubuntu1 04/01/2014
[  166.954562][ T6897] Call Trace:
[  166.955268][ T6897]  <TASK>
[  166.955918][ T6897]  dump_stack_lvl+0x57/0x7d
[  166.956875][ T6897]  print_address_description.constprop.0.cold+0x93/0x347
[  166.958411][ T6897]  ? _copy_to_user+0x87/0xb0
[  166.959356][ T6897]  ? _copy_to_user+0x87/0xb0
[  166.960272][ T6897]  kasan_report.cold+0x83/0xdf
[  166.961196][ T6897]  ? _copy_to_user+0x87/0xb0
[  166.962053][ T6897]  kasan_check_range+0x13b/0x190
[  166.962978][ T6897]  _copy_to_user+0x87/0xb0
[  166.964340][ T6897]  __htab_map_lookup_and_delete_batch+0xdc2/0x1590
[  166.965619][ T6897]  ? htab_lru_map_update_elem+0xe70/0xe70
[  166.966732][ T6897]  bpf_map_do_batch+0x1fa/0x460
[  166.967619][ T6897]  __sys_bpf+0x99a/0x3860
[  166.968443][ T6897]  ? bpf_link_get_from_fd+0xd0/0xd0
[  166.969393][ T6897]  ? rcu_read_lock_sched_held+0x9c/0xd0
[  166.970425][ T6897]  ? lock_acquire+0x1ab/0x520
[  166.971284][ T6897]  ? find_held_lock+0x2d/0x110
[  166.972208][ T6897]  ? rcu_read_lock_sched_held+0x9c/0xd0
[  166.973139][ T6897]  ? rcu_read_lock_bh_held+0xb0/0xb0
[  166.974096][ T6897]  __x64_sys_bpf+0x70/0xb0
[  166.974903][ T6897]  ? syscall_enter_from_user_mode+0x21/0x70
[  166.976077][ T6897]  do_syscall_64+0x35/0xb0
[  166.976889][ T6897]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  166.978027][ T6897] RIP: 0033:0x450f0d


In hashtable, if the elements' keys have the same jhash() value, the
elements will be put into the same bucket.
By putting a lot of elements into a single bucket, the value of
bucket_size can be increased to overflow.
 but also we can increase bucket_cnt to out of bound Read.

the out of bound Read in  __htab_map_lookup_and_delete_batch code:
```
...
if (bucket_cnt && (copy_to_user(ukeys + total * key_size, keys,
key_size * bucket_cnt) ||
    copy_to_user(uvalues + total * value_size, values,
    value_size * bucket_cnt))) {
ret = -EFAULT;
goto after_loop;
}
...
```

Regards,
 butt3rflyh4ck.


--
Active Defense Lab of Venustech

^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2022-01-07  5:42 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-29 10:10 A slab-out-of-bounds Read bug in __htab_map_lookup_and_delete_batch butt3rflyh4ck
2021-12-30  2:23 ` Alexei Starovoitov
2021-12-30  3:23   ` butt3rflyh4ck
2021-12-30  4:00     ` Alexei Starovoitov
2022-01-06  6:02       ` butt3rflyh4ck
2022-01-07  1:19     ` Yonghong Song
2022-01-07  3:25       ` butt3rflyh4ck
2022-01-07  4:02         ` Yonghong Song
2022-01-07  5:42           ` butt3rflyh4ck

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).