* net/ipv6: slab-out-of-bounds in ip6_tnl_xmit
@ 2017-04-24 15:03 Andrey Konovalov
2017-04-24 16:24 ` Andrey Konovalov
2017-04-24 16:47 ` Cong Wang
0 siblings, 2 replies; 5+ messages in thread
From: Andrey Konovalov @ 2017-04-24 15:03 UTC (permalink / raw)
To: David S. Miller, Alexey Kuznetsov, James Morris,
Hideaki YOSHIFUJI, Patrick McHardy, netdev, LKML
Cc: Eric Dumazet, Cong Wang, Dmitry Vyukov, Kostya Serebryany, syzkaller
Hi,
I've got the following error report while fuzzing the kernel with syzkaller.
On commit 5a7ad1146caa895ad718a534399e38bd2ba721b7 (4.11-rc8).
Unfortunately it's not reproducible.
The issue might be similar to this one:
https://groups.google.com/forum/#!topic/syzkaller/IDoQHFmrnRI
==================================================================
BUG: KASAN: slab-out-of-bounds in ip6_tnl_xmit+0x25dd/0x28f0
net/ipv6/ip6_tunnel.c:1078 at addr ffff88005dcc5f98
Read of size 16 by task syz-executor7/8076
CPU: 3 PID: 8076 Comm: syz-executor7 Not tainted 4.11.0-rc8+ #266
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x192/0x22d lib/dump_stack.c:52
kasan_object_err+0x1c/0x70 mm/kasan/report.c:164
print_address_description mm/kasan/report.c:202 [inline]
kasan_report_error mm/kasan/report.c:291 [inline]
kasan_report+0x252/0x510 mm/kasan/report.c:347
__asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:378
ip6_tnl_xmit+0x25dd/0x28f0 net/ipv6/ip6_tunnel.c:1078
ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1268 [inline]
ip6_tnl_start_xmit+0xc1e/0x1890 net/ipv6/ip6_tunnel.c:1370
__netdev_start_xmit include/linux/netdevice.h:3980 [inline]
netdev_start_xmit include/linux/netdevice.h:3989 [inline]
xmit_one net/core/dev.c:2908 [inline]
dev_hard_start_xmit+0x213/0x800 net/core/dev.c:2924
__dev_queue_xmit+0x1abc/0x2580 net/core/dev.c:3391
dev_queue_xmit+0x17/0x20 net/core/dev.c:3424
neigh_direct_output+0x15/0x20 net/core/neighbour.c:1349
neigh_output include/net/neighbour.h:478 [inline]
ip_finish_output2+0x7cd/0x1020 net/ipv4/ip_output.c:228
ip_finish_output+0x83d/0xc30 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:246 [inline]
ip_output+0x1e7/0x5d0 net/ipv4/ip_output.c:404
dst_output include/net/dst.h:486 [inline]
ip_local_out+0x82/0xb0 net/ipv4/ip_output.c:124
ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1492
ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1512
ping_v4_push_pending_frames net/ipv4/ping.c:653 [inline]
ping_v4_sendmsg+0x1b35/0x23e0 net/ipv4/ping.c:840
inet_sendmsg+0x164/0x490 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:643
SYSC_sendto+0x660/0x810 net/socket.c:1696
SyS_sendto+0x40/0x50 net/socket.c:1664
entry_SYSCALL_64_fastpath+0x1a/0xa9
RIP: 0033:0x4458d9
RSP: 002b:00007f853159db58 EFLAGS: 00000282 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000708000 RCX: 00000000004458d9
RDX: 0000000000000008 RSI: 00000000204f9fe1 RDI: 0000000000000017
RBP: 0000000000003410 R08: 0000000020235000 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000282 R12: 00000000006e24d0
R13: 0000000020ef8000 R14: 0000000000001000 R15: 0000000000000003
Object at ffff88005dcc5e20, in cache kmalloc-512 size: 512
Allocated:
PID = 8076
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:513
set_track mm/kasan/kasan.c:525 [inline]
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616
__kmalloc+0x7c/0x1c0 mm/slub.c:3745
kmalloc include/linux/slab.h:495 [inline]
kzalloc include/linux/slab.h:663 [inline]
neigh_alloc net/core/neighbour.c:286 [inline]
__neigh_create+0x386/0x1da0 net/core/neighbour.c:458
neigh_create include/net/neighbour.h:313 [inline]
ipv4_neigh_lookup+0x4bb/0x730 net/ipv4/route.c:463
dst_neigh_lookup include/net/dst.h:447 [inline]
ip6_tnl_xmit+0x1598/0x28f0 net/ipv6/ip6_tunnel.c:1067
ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1268 [inline]
ip6_tnl_start_xmit+0xc1e/0x1890 net/ipv6/ip6_tunnel.c:1370
__netdev_start_xmit include/linux/netdevice.h:3980 [inline]
netdev_start_xmit include/linux/netdevice.h:3989 [inline]
xmit_one net/core/dev.c:2908 [inline]
dev_hard_start_xmit+0x213/0x800 net/core/dev.c:2924
__dev_queue_xmit+0x1abc/0x2580 net/core/dev.c:3391
dev_queue_xmit+0x17/0x20 net/core/dev.c:3424
neigh_direct_output+0x15/0x20 net/core/neighbour.c:1349
neigh_output include/net/neighbour.h:478 [inline]
ip_finish_output2+0x7cd/0x1020 net/ipv4/ip_output.c:228
ip_finish_output+0x83d/0xc30 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:246 [inline]
ip_output+0x1e7/0x5d0 net/ipv4/ip_output.c:404
dst_output include/net/dst.h:486 [inline]
ip_local_out+0x82/0xb0 net/ipv4/ip_output.c:124
ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1492
ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1512
ping_v4_push_pending_frames net/ipv4/ping.c:653 [inline]
ping_v4_sendmsg+0x1b35/0x23e0 net/ipv4/ping.c:840
inet_sendmsg+0x164/0x490 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:643
SYSC_sendto+0x660/0x810 net/socket.c:1696
SyS_sendto+0x40/0x50 net/socket.c:1664
entry_SYSCALL_64_fastpath+0x1a/0xa9
Freed:
PID = 7604
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:513
set_track mm/kasan/kasan.c:525 [inline]
kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:589
slab_free_hook mm/slub.c:1357 [inline]
slab_free_freelist_hook mm/slub.c:1379 [inline]
slab_free mm/slub.c:2961 [inline]
kfree+0x91/0x190 mm/slub.c:3882
skb_free_head+0x74/0xb0 net/core/skbuff.c:579
skb_release_data+0x37c/0x440 net/core/skbuff.c:610
skb_release_all+0x4a/0x60 net/core/skbuff.c:669
__kfree_skb net/core/skbuff.c:683 [inline]
consume_skb+0x130/0x2f0 net/core/skbuff.c:756
netlink_broadcast_filtered+0x5fa/0x1420 net/netlink/af_netlink.c:1473
netlink_broadcast net/netlink/af_netlink.c:1495 [inline]
nlmsg_multicast include/net/netlink.h:577 [inline]
nlmsg_notify+0x9c/0x140 net/netlink/af_netlink.c:2382
rtnl_notify+0xbb/0xe0 net/core/rtnetlink.c:674
rtmsg_fib+0x3a7/0x4b0 net/ipv4/fib_semantics.c:422
fib_table_delete+0x836/0x1140 net/ipv4/fib_trie.c:1659
fib_magic.isra.14+0x4b3/0x890 net/ipv4/fib_frontend.c:840
fib_del_ifaddr+0xb20/0xe10 net/ipv4/fib_frontend.c:1013
fib_inetaddr_event+0xaf/0x200 net/ipv4/fib_frontend.c:1150
notifier_call_chain+0x145/0x2f0 kernel/notifier.c:93
__blocking_notifier_call_chain kernel/notifier.c:317 [inline]
blocking_notifier_call_chain+0x109/0x1a0 kernel/notifier.c:328
__inet_del_ifa+0x4b5/0xb00 net/ipv4/devinet.c:402
inet_del_ifa net/ipv4/devinet.c:432 [inline]
devinet_ioctl+0xa75/0x1a10 net/ipv4/devinet.c:1073
inet_ioctl+0x117/0x1c0 net/ipv4/af_inet.c:900
sock_do_ioctl+0x65/0xb0 net/socket.c:906
sock_ioctl+0x27a/0x410 net/socket.c:1004
vfs_ioctl fs/ioctl.c:45 [inline]
do_vfs_ioctl+0x1cd/0x15a0 fs/ioctl.c:685
SYSC_ioctl fs/ioctl.c:700 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
entry_SYSCALL_64_fastpath+0x1a/0xa9
Memory state around the buggy address:
ffff88005dcc5e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88005dcc5f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88005dcc5f80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88005dcc6000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88005dcc6080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit 2017-04-24 15:03 net/ipv6: slab-out-of-bounds in ip6_tnl_xmit Andrey Konovalov @ 2017-04-24 16:24 ` Andrey Konovalov 2017-04-24 16:47 ` Cong Wang 1 sibling, 0 replies; 5+ messages in thread From: Andrey Konovalov @ 2017-04-24 16:24 UTC (permalink / raw) To: David S. Miller, Alexey Kuznetsov, James Morris, Hideaki YOSHIFUJI, Patrick McHardy, netdev, LKML On Mon, Apr 24, 2017 at 5:03 PM, Andrey Konovalov <andreyknvl@google.com> wrote: > Hi, > > I've got the following error report while fuzzing the kernel with syzkaller. > > On commit 5a7ad1146caa895ad718a534399e38bd2ba721b7 (4.11-rc8). > > Unfortunately it's not reproducible. > > The issue might be similar to this one: > https://groups.google.com/forum/#!topic/syzkaller/IDoQHFmrnRI > > ================================================================== > BUG: KASAN: slab-out-of-bounds in ip6_tnl_xmit+0x25dd/0x28f0 > net/ipv6/ip6_tunnel.c:1078 at addr ffff88005dcc5f98 > Read of size 16 by task syz-executor7/8076 > CPU: 3 PID: 8076 Comm: syz-executor7 Not tainted 4.11.0-rc8+ #266 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:16 [inline] > dump_stack+0x192/0x22d lib/dump_stack.c:52 > kasan_object_err+0x1c/0x70 mm/kasan/report.c:164 > print_address_description mm/kasan/report.c:202 [inline] > kasan_report_error mm/kasan/report.c:291 [inline] > kasan_report+0x252/0x510 mm/kasan/report.c:347 > __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:378 > ip6_tnl_xmit+0x25dd/0x28f0 net/ipv6/ip6_tunnel.c:1078 > ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1268 [inline] > ip6_tnl_start_xmit+0xc1e/0x1890 net/ipv6/ip6_tunnel.c:1370 > __netdev_start_xmit include/linux/netdevice.h:3980 [inline] > netdev_start_xmit include/linux/netdevice.h:3989 [inline] > xmit_one net/core/dev.c:2908 [inline] > dev_hard_start_xmit+0x213/0x800 net/core/dev.c:2924 > __dev_queue_xmit+0x1abc/0x2580 net/core/dev.c:3391 > dev_queue_xmit+0x17/0x20 net/core/dev.c:3424 > neigh_direct_output+0x15/0x20 net/core/neighbour.c:1349 > neigh_output include/net/neighbour.h:478 [inline] > ip_finish_output2+0x7cd/0x1020 net/ipv4/ip_output.c:228 > ip_finish_output+0x83d/0xc30 net/ipv4/ip_output.c:316 > NF_HOOK_COND include/linux/netfilter.h:246 [inline] > ip_output+0x1e7/0x5d0 net/ipv4/ip_output.c:404 > dst_output include/net/dst.h:486 [inline] > ip_local_out+0x82/0xb0 net/ipv4/ip_output.c:124 > ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1492 > ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1512 > ping_v4_push_pending_frames net/ipv4/ping.c:653 [inline] > ping_v4_sendmsg+0x1b35/0x23e0 net/ipv4/ping.c:840 > inet_sendmsg+0x164/0x490 net/ipv4/af_inet.c:762 > sock_sendmsg_nosec net/socket.c:633 [inline] > sock_sendmsg+0xca/0x110 net/socket.c:643 > SYSC_sendto+0x660/0x810 net/socket.c:1696 > SyS_sendto+0x40/0x50 net/socket.c:1664 > entry_SYSCALL_64_fastpath+0x1a/0xa9 > RIP: 0033:0x4458d9 > RSP: 002b:00007f853159db58 EFLAGS: 00000282 ORIG_RAX: 000000000000002c > RAX: ffffffffffffffda RBX: 0000000000708000 RCX: 00000000004458d9 > RDX: 0000000000000008 RSI: 00000000204f9fe1 RDI: 0000000000000017 > RBP: 0000000000003410 R08: 0000000020235000 R09: 0000000000000010 > R10: 0000000000000000 R11: 0000000000000282 R12: 00000000006e24d0 > R13: 0000000020ef8000 R14: 0000000000001000 R15: 0000000000000003 > Object at ffff88005dcc5e20, in cache kmalloc-512 size: 512 > Allocated: > PID = 8076 > save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 > save_stack+0x43/0xd0 mm/kasan/kasan.c:513 > set_track mm/kasan/kasan.c:525 [inline] > kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616 > __kmalloc+0x7c/0x1c0 mm/slub.c:3745 > kmalloc include/linux/slab.h:495 [inline] > kzalloc include/linux/slab.h:663 [inline] > neigh_alloc net/core/neighbour.c:286 [inline] > __neigh_create+0x386/0x1da0 net/core/neighbour.c:458 > neigh_create include/net/neighbour.h:313 [inline] > ipv4_neigh_lookup+0x4bb/0x730 net/ipv4/route.c:463 > dst_neigh_lookup include/net/dst.h:447 [inline] > ip6_tnl_xmit+0x1598/0x28f0 net/ipv6/ip6_tunnel.c:1067 > ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1268 [inline] > ip6_tnl_start_xmit+0xc1e/0x1890 net/ipv6/ip6_tunnel.c:1370 > __netdev_start_xmit include/linux/netdevice.h:3980 [inline] > netdev_start_xmit include/linux/netdevice.h:3989 [inline] > xmit_one net/core/dev.c:2908 [inline] > dev_hard_start_xmit+0x213/0x800 net/core/dev.c:2924 > __dev_queue_xmit+0x1abc/0x2580 net/core/dev.c:3391 > dev_queue_xmit+0x17/0x20 net/core/dev.c:3424 > neigh_direct_output+0x15/0x20 net/core/neighbour.c:1349 > neigh_output include/net/neighbour.h:478 [inline] > ip_finish_output2+0x7cd/0x1020 net/ipv4/ip_output.c:228 > ip_finish_output+0x83d/0xc30 net/ipv4/ip_output.c:316 > NF_HOOK_COND include/linux/netfilter.h:246 [inline] > ip_output+0x1e7/0x5d0 net/ipv4/ip_output.c:404 > dst_output include/net/dst.h:486 [inline] > ip_local_out+0x82/0xb0 net/ipv4/ip_output.c:124 > ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1492 > ip_push_pending_frames+0x64/0x80 net/ipv4/ip_output.c:1512 > ping_v4_push_pending_frames net/ipv4/ping.c:653 [inline] > ping_v4_sendmsg+0x1b35/0x23e0 net/ipv4/ping.c:840 > inet_sendmsg+0x164/0x490 net/ipv4/af_inet.c:762 > sock_sendmsg_nosec net/socket.c:633 [inline] > sock_sendmsg+0xca/0x110 net/socket.c:643 > SYSC_sendto+0x660/0x810 net/socket.c:1696 > SyS_sendto+0x40/0x50 net/socket.c:1664 > entry_SYSCALL_64_fastpath+0x1a/0xa9 > Freed: > PID = 7604 > save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 > save_stack+0x43/0xd0 mm/kasan/kasan.c:513 > set_track mm/kasan/kasan.c:525 [inline] > kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:589 > slab_free_hook mm/slub.c:1357 [inline] > slab_free_freelist_hook mm/slub.c:1379 [inline] > slab_free mm/slub.c:2961 [inline] > kfree+0x91/0x190 mm/slub.c:3882 > skb_free_head+0x74/0xb0 net/core/skbuff.c:579 > skb_release_data+0x37c/0x440 net/core/skbuff.c:610 > skb_release_all+0x4a/0x60 net/core/skbuff.c:669 > __kfree_skb net/core/skbuff.c:683 [inline] > consume_skb+0x130/0x2f0 net/core/skbuff.c:756 > netlink_broadcast_filtered+0x5fa/0x1420 net/netlink/af_netlink.c:1473 > netlink_broadcast net/netlink/af_netlink.c:1495 [inline] > nlmsg_multicast include/net/netlink.h:577 [inline] > nlmsg_notify+0x9c/0x140 net/netlink/af_netlink.c:2382 > rtnl_notify+0xbb/0xe0 net/core/rtnetlink.c:674 > rtmsg_fib+0x3a7/0x4b0 net/ipv4/fib_semantics.c:422 > fib_table_delete+0x836/0x1140 net/ipv4/fib_trie.c:1659 > fib_magic.isra.14+0x4b3/0x890 net/ipv4/fib_frontend.c:840 > fib_del_ifaddr+0xb20/0xe10 net/ipv4/fib_frontend.c:1013 > fib_inetaddr_event+0xaf/0x200 net/ipv4/fib_frontend.c:1150 > notifier_call_chain+0x145/0x2f0 kernel/notifier.c:93 > __blocking_notifier_call_chain kernel/notifier.c:317 [inline] > blocking_notifier_call_chain+0x109/0x1a0 kernel/notifier.c:328 > __inet_del_ifa+0x4b5/0xb00 net/ipv4/devinet.c:402 > inet_del_ifa net/ipv4/devinet.c:432 [inline] > devinet_ioctl+0xa75/0x1a10 net/ipv4/devinet.c:1073 > inet_ioctl+0x117/0x1c0 net/ipv4/af_inet.c:900 > sock_do_ioctl+0x65/0xb0 net/socket.c:906 > sock_ioctl+0x27a/0x410 net/socket.c:1004 > vfs_ioctl fs/ioctl.c:45 [inline] > do_vfs_ioctl+0x1cd/0x15a0 fs/ioctl.c:685 > SYSC_ioctl fs/ioctl.c:700 [inline] > SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691 > entry_SYSCALL_64_fastpath+0x1a/0xa9 > Memory state around the buggy address: > ffff88005dcc5e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffff88005dcc5f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>ffff88005dcc5f80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc > ^ > ffff88005dcc6000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff88005dcc6080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ================================================================== Another report which is probably caused by the same issue: ================================================================== BUG: KASAN: slab-out-of-bounds in __ipv6_addr_type+0x273/0x280 net/ipv6/addrconf_core.c:68 at addr ffff88006a8ed598 Read of size 4 by task syz-executor2/10023 CPU: 3 PID: 10023 Comm: syz-executor2 Not tainted 4.11.0-rc8+ #266 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x192/0x22d lib/dump_stack.c:52 kasan_object_err+0x1c/0x70 mm/kasan/report.c:164 print_address_description mm/kasan/report.c:202 [inline] kasan_report_error mm/kasan/report.c:291 [inline] kasan_report+0x252/0x510 mm/kasan/report.c:347 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:367 __ipv6_addr_type+0x273/0x280 net/ipv6/addrconf_core.c:68 ipv6_addr_type include/net/ipv6.h:353 [inline] ip6_tnl_xmit+0x15d2/0x28f0 net/ipv6/ip6_tunnel.c:1073 ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1268 [inline] ip6_tnl_start_xmit+0xc1e/0x1890 net/ipv6/ip6_tunnel.c:1370 __netdev_start_xmit include/linux/netdevice.h:3980 [inline] netdev_start_xmit include/linux/netdevice.h:3989 [inline] xmit_one net/core/dev.c:2908 [inline] dev_hard_start_xmit+0x213/0x800 net/core/dev.c:2924 __dev_queue_xmit+0x1abc/0x2580 net/core/dev.c:3391 dev_queue_xmit+0x17/0x20 net/core/dev.c:3424 neigh_direct_output+0x15/0x20 net/core/neighbour.c:1349 neigh_output include/net/neighbour.h:478 [inline] ip_finish_output2+0x7cd/0x1020 net/ipv4/ip_output.c:228 ip_finish_output+0x83d/0xc30 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:246 [inline] ip_output+0x1e7/0x5d0 net/ipv4/ip_output.c:404 dst_output include/net/dst.h:486 [inline] ip_local_out+0x82/0xb0 net/ipv4/ip_output.c:124 ip_queue_xmit+0x927/0x1730 net/ipv4/ip_output.c:503 sctp_v4_xmit+0x10d/0x140 net/sctp/protocol.c:994 sctp_packet_transmit+0x22ea/0x3030 net/sctp/output.c:637 sctp_outq_flush+0xad8/0x3f90 net/sctp/outqueue.c:885 sctp_outq_uncork+0x5a/0x70 net/sctp/outqueue.c:750 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1773 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1175 [inline] sctp_do_sm+0x5a0/0x6a50 net/sctp/sm_sideeffect.c:1147 sctp_primitive_ASSOCIATE+0x9d/0xd0 net/sctp/primitive.c:88 sctp_sendmsg+0x2707/0x3b50 net/sctp/socket.c:1954 inet_sendmsg+0x164/0x490 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 [inline] sock_sendmsg+0xca/0x110 net/socket.c:643 ___sys_sendmsg+0x4fa/0xb70 net/socket.c:1997 __sys_sendmmsg+0x25b/0x730 net/socket.c:2087 SYSC_sendmmsg net/socket.c:2118 [inline] SyS_sendmmsg+0x35/0x60 net/socket.c:2113 entry_SYSCALL_64_fastpath+0x1a/0xa9 RIP: 0033:0x4458d9 RSP: 002b:00007f0939404b58 EFLAGS: 00000292 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f0939405700 RCX: 00000000004458d9 RDX: 0000000000000001 RSI: 00000000204bcfc8 RDI: 0000000000000016 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000008001 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f09394059c0 R15: 00007f0939405700 Object at ffff88006a8ed418, in cache kmalloc-512 size: 512 Allocated: PID = 10023 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:513 set_track mm/kasan/kasan.c:525 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616 __kmalloc+0x7c/0x1c0 mm/slub.c:3745 kmalloc include/linux/slab.h:495 [inline] kzalloc include/linux/slab.h:663 [inline] neigh_alloc net/core/neighbour.c:286 [inline] __neigh_create+0x386/0x1da0 net/core/neighbour.c:458 neigh_create include/net/neighbour.h:313 [inline] ipv4_neigh_lookup+0x4bb/0x730 net/ipv4/route.c:463 dst_neigh_lookup include/net/dst.h:447 [inline] ip6_tnl_xmit+0x1598/0x28f0 net/ipv6/ip6_tunnel.c:1067 ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1268 [inline] ip6_tnl_start_xmit+0xc1e/0x1890 net/ipv6/ip6_tunnel.c:1370 __netdev_start_xmit include/linux/netdevice.h:3980 [inline] netdev_start_xmit include/linux/netdevice.h:3989 [inline] xmit_one net/core/dev.c:2908 [inline] dev_hard_start_xmit+0x213/0x800 net/core/dev.c:2924 __dev_queue_xmit+0x1abc/0x2580 net/core/dev.c:3391 dev_queue_xmit+0x17/0x20 net/core/dev.c:3424 neigh_direct_output+0x15/0x20 net/core/neighbour.c:1349 neigh_output include/net/neighbour.h:478 [inline] ip_finish_output2+0x7cd/0x1020 net/ipv4/ip_output.c:228 ip_finish_output+0x83d/0xc30 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:246 [inline] ip_output+0x1e7/0x5d0 net/ipv4/ip_output.c:404 dst_output include/net/dst.h:486 [inline] ip_local_out+0x82/0xb0 net/ipv4/ip_output.c:124 ip_queue_xmit+0x927/0x1730 net/ipv4/ip_output.c:503 sctp_v4_xmit+0x10d/0x140 net/sctp/protocol.c:994 sctp_packet_transmit+0x22ea/0x3030 net/sctp/output.c:637 sctp_outq_flush+0xad8/0x3f90 net/sctp/outqueue.c:885 sctp_outq_uncork+0x5a/0x70 net/sctp/outqueue.c:750 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1773 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1175 [inline] sctp_do_sm+0x5a0/0x6a50 net/sctp/sm_sideeffect.c:1147 sctp_primitive_ASSOCIATE+0x9d/0xd0 net/sctp/primitive.c:88 sctp_sendmsg+0x2707/0x3b50 net/sctp/socket.c:1954 inet_sendmsg+0x164/0x490 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 [inline] sock_sendmsg+0xca/0x110 net/socket.c:643 ___sys_sendmsg+0x4fa/0xb70 net/socket.c:1997 __sys_sendmmsg+0x25b/0x730 net/socket.c:2087 SYSC_sendmmsg net/socket.c:2118 [inline] SyS_sendmmsg+0x35/0x60 net/socket.c:2113 entry_SYSCALL_64_fastpath+0x1a/0xa9 Freed: PID = 9423 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:513 set_track mm/kasan/kasan.c:525 [inline] kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:589 slab_free_hook mm/slub.c:1357 [inline] slab_free_freelist_hook mm/slub.c:1379 [inline] slab_free mm/slub.c:2961 [inline] kfree+0x91/0x190 mm/slub.c:3882 skb_free_head+0x74/0xb0 net/core/skbuff.c:579 skb_release_data+0x37c/0x440 net/core/skbuff.c:610 skb_release_all+0x4a/0x60 net/core/skbuff.c:669 __kfree_skb net/core/skbuff.c:683 [inline] consume_skb+0x130/0x2f0 net/core/skbuff.c:756 sctp_chunk_destroy net/sctp/sm_make_chunk.c:1442 [inline] sctp_chunk_put+0x2b6/0x430 net/sctp/sm_make_chunk.c:1469 sctp_chunk_free+0x53/0x60 net/sctp/sm_make_chunk.c:1456 __sctp_outq_teardown+0xb03/0x15b0 net/sctp/outqueue.c:264 sctp_outq_free+0x15/0x20 net/sctp/outqueue.c:284 sctp_association_free+0x2cf/0x970 net/sctp/associola.c:357 sctp_cmd_delete_tcb net/sctp/sm_sideeffect.c:895 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1310 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1175 [inline] sctp_do_sm+0x2732/0x6a50 net/sctp/sm_sideeffect.c:1147 sctp_assoc_bh_rcv+0x27f/0x4b0 net/sctp/associola.c:1066 sctp_inq_push+0x22b/0x2f0 net/sctp/inqueue.c:95 sctp_backlog_rcv+0x185/0xc10 net/sctp/input.c:350 sk_backlog_rcv include/net/sock.h:898 [inline] __release_sock+0x189/0x300 net/core/sock.c:2069 release_sock+0xa5/0x2a0 net/core/sock.c:2564 sctp_wait_for_connect+0x363/0x630 net/sctp/socket.c:7717 sctp_sendmsg+0x32c7/0x3b50 net/sctp/socket.c:1999 inet_sendmsg+0x164/0x490 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 [inline] sock_sendmsg+0xca/0x110 net/socket.c:643 SYSC_sendto+0x660/0x810 net/socket.c:1696 SyS_sendto+0x40/0x50 net/socket.c:1664 entry_SYSCALL_64_fastpath+0x1a/0xa9 Memory state around the buggy address: ffff88006a8ed480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88006a8ed500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88006a8ed580: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88006a8ed600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88006a8ed680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit 2017-04-24 15:03 net/ipv6: slab-out-of-bounds in ip6_tnl_xmit Andrey Konovalov 2017-04-24 16:24 ` Andrey Konovalov @ 2017-04-24 16:47 ` Cong Wang 2017-04-25 5:04 ` Cong Wang 1 sibling, 1 reply; 5+ messages in thread From: Cong Wang @ 2017-04-24 16:47 UTC (permalink / raw) To: Andrey Konovalov Cc: David S. Miller, Alexey Kuznetsov, James Morris, Hideaki YOSHIFUJI, Patrick McHardy, netdev, LKML, Eric Dumazet, Dmitry Vyukov, Kostya Serebryany, syzkaller On Mon, Apr 24, 2017 at 8:03 AM, Andrey Konovalov <andreyknvl@google.com> wrote: > Hi, > > I've got the following error report while fuzzing the kernel with syzkaller. > > On commit 5a7ad1146caa895ad718a534399e38bd2ba721b7 (4.11-rc8). > > Unfortunately it's not reproducible. > > The issue might be similar to this one: > https://groups.google.com/forum/#!topic/syzkaller/IDoQHFmrnRI > > ================================================================== > BUG: KASAN: slab-out-of-bounds in ip6_tnl_xmit+0x25dd/0x28f0 > net/ipv6/ip6_tunnel.c:1078 at addr ffff88005dcc5f98 > Read of size 16 by task syz-executor7/8076 > CPU: 3 PID: 8076 Comm: syz-executor7 Not tainted 4.11.0-rc8+ #266 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:16 [inline] > dump_stack+0x192/0x22d lib/dump_stack.c:52 > kasan_object_err+0x1c/0x70 mm/kasan/report.c:164 > print_address_description mm/kasan/report.c:202 [inline] > kasan_report_error mm/kasan/report.c:291 [inline] > kasan_report+0x252/0x510 mm/kasan/report.c:347 > __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:378 > ip6_tnl_xmit+0x25dd/0x28f0 net/ipv6/ip6_tunnel.c:1078 > ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1268 [inline] > ip6_tnl_start_xmit+0xc1e/0x1890 net/ipv6/ip6_tunnel.c:1370 We use ipv4 dst in ip6_tunnel and cast an IPv4 neigh key as an IPv6 address... neigh = dst_neigh_lookup(skb_dst(skb), &ipv6_hdr(skb)->daddr); if (!neigh) goto tx_err_link_failure; addr6 = (struct in6_addr *)&neigh->primary_key; // <=== HERE addr_type = ipv6_addr_type(addr6); if (addr_type == IPV6_ADDR_ANY) addr6 = &ipv6_hdr(skb)->daddr; memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); Also the network header of the skb at this point should be still IPv4? ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit 2017-04-24 16:47 ` Cong Wang @ 2017-04-25 5:04 ` Cong Wang 2017-04-25 12:32 ` Andrey Konovalov 0 siblings, 1 reply; 5+ messages in thread From: Cong Wang @ 2017-04-25 5:04 UTC (permalink / raw) To: Andrey Konovalov Cc: David S. Miller, Alexey Kuznetsov, James Morris, Hideaki YOSHIFUJI, Patrick McHardy, netdev, LKML, Eric Dumazet, Dmitry Vyukov, Kostya Serebryany, syzkaller [-- Attachment #1: Type: text/plain, Size: 889 bytes --] On Mon, Apr 24, 2017 at 9:47 AM, Cong Wang <xiyou.wangcong@gmail.com> wrote: > > We use ipv4 dst in ip6_tunnel and cast an IPv4 neigh key as an > IPv6 address... > > > neigh = dst_neigh_lookup(skb_dst(skb), > &ipv6_hdr(skb)->daddr); > if (!neigh) > goto tx_err_link_failure; > > addr6 = (struct in6_addr *)&neigh->primary_key; // <=== HERE > addr_type = ipv6_addr_type(addr6); > > if (addr_type == IPV6_ADDR_ANY) > addr6 = &ipv6_hdr(skb)->daddr; > > memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); > > Also the network header of the skb at this point should be still IPv4? Please try the attached patch. I am not sure how we could handle 4in6 case better than just relying on the config of ip6 tunnel. [-- Attachment #2: ip6_tunnel.diff --] [-- Type: text/plain, Size: 1888 bytes --] diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 75fac93..a9692ec 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1037,7 +1037,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, struct ip6_tnl *t = netdev_priv(dev); struct net *net = t->net; struct net_device_stats *stats = &t->dev->stats; - struct ipv6hdr *ipv6h = ipv6_hdr(skb); + struct ipv6hdr *ipv6h; struct ipv6_tel_txoption opt; struct dst_entry *dst = NULL, *ndst = NULL; struct net_device *tdev; @@ -1057,26 +1057,28 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, /* NBMA tunnel */ if (ipv6_addr_any(&t->parms.raddr)) { - struct in6_addr *addr6; - struct neighbour *neigh; - int addr_type; + if (skb->protocol == htons(ETH_P_IPV6)) { + struct in6_addr *addr6; + struct neighbour *neigh; + int addr_type; - if (!skb_dst(skb)) - goto tx_err_link_failure; + if (!skb_dst(skb)) + goto tx_err_link_failure; - neigh = dst_neigh_lookup(skb_dst(skb), - &ipv6_hdr(skb)->daddr); - if (!neigh) - goto tx_err_link_failure; + neigh = dst_neigh_lookup(skb_dst(skb), + &ipv6_hdr(skb)->daddr); + if (!neigh) + goto tx_err_link_failure; - addr6 = (struct in6_addr *)&neigh->primary_key; - addr_type = ipv6_addr_type(addr6); + addr6 = (struct in6_addr *)&neigh->primary_key; + addr_type = ipv6_addr_type(addr6); - if (addr_type == IPV6_ADDR_ANY) - addr6 = &ipv6_hdr(skb)->daddr; + if (addr_type == IPV6_ADDR_ANY) + addr6 = &ipv6_hdr(skb)->daddr; - memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); - neigh_release(neigh); + memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); + neigh_release(neigh); + } } else if (!(t->parms.flags & (IP6_TNL_F_USE_ORIG_TCLASS | IP6_TNL_F_USE_ORIG_FWMARK))) { /* enable the cache only only if the routing decision does ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit 2017-04-25 5:04 ` Cong Wang @ 2017-04-25 12:32 ` Andrey Konovalov 0 siblings, 0 replies; 5+ messages in thread From: Andrey Konovalov @ 2017-04-25 12:32 UTC (permalink / raw) To: Cong Wang Cc: David S. Miller, Alexey Kuznetsov, James Morris, Hideaki YOSHIFUJI, Patrick McHardy, netdev, LKML, Eric Dumazet, Dmitry Vyukov, Kostya Serebryany, syzkaller On Tue, Apr 25, 2017 at 7:04 AM, Cong Wang <xiyou.wangcong@gmail.com> wrote: > On Mon, Apr 24, 2017 at 9:47 AM, Cong Wang <xiyou.wangcong@gmail.com> wrote: >> >> We use ipv4 dst in ip6_tunnel and cast an IPv4 neigh key as an >> IPv6 address... >> >> >> neigh = dst_neigh_lookup(skb_dst(skb), >> &ipv6_hdr(skb)->daddr); >> if (!neigh) >> goto tx_err_link_failure; >> >> addr6 = (struct in6_addr *)&neigh->primary_key; // <=== HERE >> addr_type = ipv6_addr_type(addr6); >> >> if (addr_type == IPV6_ADDR_ANY) >> addr6 = &ipv6_hdr(skb)->daddr; >> >> memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); >> >> Also the network header of the skb at this point should be still IPv4? > > Please try the attached patch. I don't see these crashes with your patch. Thanks! Tested-by: Andrey Konovalov <andreyknvl@google.com> > > I am not sure how we could handle 4in6 case better than just relying on > the config of ip6 tunnel. ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2017-04-25 12:33 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2017-04-24 15:03 net/ipv6: slab-out-of-bounds in ip6_tnl_xmit Andrey Konovalov 2017-04-24 16:24 ` Andrey Konovalov 2017-04-24 16:47 ` Cong Wang 2017-04-25 5:04 ` Cong Wang 2017-04-25 12:32 ` Andrey Konovalov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).