From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stefan Hajnoczi Subject: Re: [PATCH net] VSOCK: check sk state before receive Date: Wed, 30 May 2018 10:17:27 +0100 Message-ID: <20180530091727.GF14623@stefanha-x1.localdomain> References: <1527382936-4850-1-git-send-email-liuhangbin@gmail.com> <20180527152945.GQ8958@leo.usersys.redhat.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="vA66WO2vHvL/CRSR" Cc: netdev@vger.kernel.org, Jorgen Hansen , "David S. Miller" To: Hangbin Liu Return-path: Received: from mx3-rdu2.redhat.com ([66.187.233.73]:46628 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S965314AbeE3JRa (ORCPT ); Wed, 30 May 2018 05:17:30 -0400 Content-Disposition: inline In-Reply-To: <20180527152945.GQ8958@leo.usersys.redhat.com> Sender: netdev-owner@vger.kernel.org List-ID: --vA66WO2vHvL/CRSR Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, May 27, 2018 at 11:29:45PM +0800, Hangbin Liu wrote: > Hmm...Although I won't reproduce this bug with my reproducer after > apply my patch. I could still get a similiar issue with syzkaller sock vn= et test. >=20 > It looks this patch is not complete. Here is the KASAN call trace with my= patch. > I can also reproduce it without my patch. Seems like a race between vmci_datagram_destroy_handle() and the delayed callback, vmci_transport_recv_dgram_cb(). I don't know the VMCI transport well so I'll leave this to Jorgen. > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > BUG: KASAN: use-after-free in vmci_transport_allow_dgram.part.7+0x155/0x1= a0 [vmw_vsock_vmci_transport] > Read of size 4 at addr ffff880026a3a914 by task kworker/0:2/96 >=20 > CPU: 0 PID: 96 Comm: kworker/0:2 Not tainted 4.17.0-rc6.vsock+ #28 > Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 > Workqueue: events dg_delayed_dispatch [vmw_vmci] > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0xdd/0x18e lib/dump_stack.c:113 > print_address_description+0x7a/0x3e0 mm/kasan/report.c:256 > kasan_report_error mm/kasan/report.c:354 [inline] > kasan_report+0x1dd/0x460 mm/kasan/report.c:412 > vmci_transport_allow_dgram.part.7+0x155/0x1a0 [vmw_vsock_vmci_transport] > vmci_transport_recv_dgram_cb+0x5d/0x200 [vmw_vsock_vmci_transport] > dg_delayed_dispatch+0x99/0x1b0 [vmw_vmci] > process_one_work+0xa4e/0x1720 kernel/workqueue.c:2145 > worker_thread+0x1df/0x1400 kernel/workqueue.c:2279 > kthread+0x343/0x4b0 kernel/kthread.c:240 > ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:412 >=20 > Allocated by task 2684: > set_track mm/kasan/kasan.c:460 [inline] > kasan_kmalloc+0xa0/0xd0 mm/kasan/kasan.c:553 > slab_post_alloc_hook mm/slab.h:444 [inline] > slab_alloc_node mm/slub.c:2741 [inline] > slab_alloc mm/slub.c:2749 [inline] > kmem_cache_alloc+0x105/0x330 mm/slub.c:2754 > sk_prot_alloc+0x6a/0x2c0 net/core/sock.c:1468 > sk_alloc+0xc9/0xbb0 net/core/sock.c:1528 > __vsock_create+0xc8/0x9b0 [vsock] > vsock_create+0xfd/0x1a0 [vsock] > __sock_create+0x310/0x690 net/socket.c:1285 > sock_create net/socket.c:1325 [inline] > __sys_socket+0x101/0x240 net/socket.c:1355 > __do_sys_socket net/socket.c:1364 [inline] > __se_sys_socket net/socket.c:1362 [inline] > __x64_sys_socket+0x7d/0xd0 net/socket.c:1362 > do_syscall_64+0x175/0x630 arch/x86/entry/common.c:287 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 >=20 > Freed by task 2684: > set_track mm/kasan/kasan.c:460 [inline] > __kasan_slab_free+0x130/0x180 mm/kasan/kasan.c:521 > slab_free_hook mm/slub.c:1388 [inline] > slab_free_freelist_hook mm/slub.c:1415 [inline] > slab_free mm/slub.c:2988 [inline] > kmem_cache_free+0xce/0x410 mm/slub.c:3004 > sk_prot_free net/core/sock.c:1509 [inline] > __sk_destruct+0x629/0x940 net/core/sock.c:1593 > sk_destruct+0x4e/0x90 net/core/sock.c:1601 > __sk_free+0xd3/0x320 net/core/sock.c:1612 > sk_free+0x2a/0x30 net/core/sock.c:1623 > __vsock_release+0x431/0x610 [vsock] > vsock_release+0x3c/0xc0 [vsock] > sock_release+0x91/0x200 net/socket.c:594 > sock_close+0x17/0x20 net/socket.c:1149 > __fput+0x368/0xa20 fs/file_table.c:209 > task_work_run+0x1c5/0x2a0 kernel/task_work.c:113 > exit_task_work include/linux/task_work.h:22 [inline] > do_exit+0x1876/0x26c0 kernel/exit.c:865 > do_group_exit+0x159/0x3e0 kernel/exit.c:968 > get_signal+0x65a/0x1780 kernel/signal.c:2482 > do_signal+0xa4/0x1fe0 arch/x86/kernel/signal.c:810 > exit_to_usermode_loop+0x1b8/0x260 arch/x86/entry/common.c:162 > prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] > syscall_return_slowpath arch/x86/entry/common.c:265 [inline] > do_syscall_64+0x505/0x630 arch/x86/entry/common.c:290 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 >=20 > The buggy address belongs to the object at ffff880026a3a600 > which belongs to the cache AF_VSOCK of size 1056 > The buggy address is located 788 bytes inside of > 1056-byte region [ffff880026a3a600, ffff880026a3aa20) > The buggy address belongs to the page: > page:ffffea00009a8e00 count:1 mapcount:0 mapping:0000000000000000 index:0= x0 compound_mapcount: 0 > flags: 0xfffffc0008100(slab|head) > raw: 000fffffc0008100 0000000000000000 0000000000000000 00000001000d000d > raw: dead000000000100 dead000000000200 ffff880034471a40 0000000000000000 > page dumped because: kasan: bad access detected >=20 > Memory state around the buggy address: > ffff880026a3a800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff880026a3a880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > >ffff880026a3a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ^ > ffff880026a3a980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff880026a3aa00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --vA66WO2vHvL/CRSR Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBAgAGBQJbDmwnAAoJEJykq7OBq3PI2P0IALhVTNldEc4L/ia3paOycYPp T7hjxKvfWMG2A9tjv5Ec1UrP6akMTYwMM8CC9nICLNYiClCSLb6MumGRPx8npz8c uMuXAwpqlYwavVPIphfA4MmwiEb6rQe6xDM0GIlX1/pKzN+hTSTJFf2YyRODm2RB bXAOWhVmgNj2nh7EbvGukrMzHNu+Y2ivA0Re7A3IaSf6NbadmCmJsNrEIjG/72xV /FJSIHVwz5mK9lFiYJeItfmK4YjPiFZHG2yX1O4tbhHcSR0p/0oJ1fml0oavr7rR H4VZ1CtYZ1UEEBd2v3GFVGq0l3cNAvfCiwZhNJJQnJ1WQEuYruSDUHyym44N4hU= =fnao -----END PGP SIGNATURE----- --vA66WO2vHvL/CRSR--