KASAN: stack-out-of-bounds Read in strlcpy

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 618a5108
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=126e08a9800000
kernel config: https://syzkaller.appspot.com/x/.config?x=44509e3077d6939
dashboard link: https://syzkaller.appspot.com/bug?extid=55f105a4b4a3d0de31fa
compiler: gcc (GCC) 7.1.1 20170620
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16aae0e9800000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12d79d89800000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+55f105...@syzkaller.appspotmail.com

random: sshd: uninitialized urandom read (32 bytes read, 105 bits of
entropy available)
==================================================================
BUG: KASAN: stack-out-of-bounds in strlen lib/string.c:481 [inline]
BUG: KASAN: stack-out-of-bounds in strlcpy+0x101/0x120 lib/string.c:141
Read of size 1 at addr ffff8801d742fb3c by task syzkaller406068/3321

CPU: 1 PID: 3321 Comm: syzkaller406068 Not tainted 4.4.110-g618a510 #15
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
0000000000000000 1e45d3b5c2de3ff3 ffff8801d742fa18 ffffffff81d04e3d
ffffea00075d0bc0 ffff8801d742fb3c 0000000000000000 ffff8801d742fb3c
ffff8801d742fc20 ffff8801d742fa50 ffffffff814fd1f3 ffff8801d742fb3c
Call Trace:
[<ffffffff81d04e3d>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81d04e3d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
[<ffffffff814fd1f3>] print_address_description+0x73/0x260
mm/kasan/report.c:252
[<ffffffff814fd705>] kasan_report_error mm/kasan/report.c:351 [inline]
[<ffffffff814fd705>] kasan_report+0x285/0x370 mm/kasan/report.c:408
[<ffffffff814fd804>] __asan_report_load1_noabort+0x14/0x20
mm/kasan/report.c:426
[<ffffffff81d21ce1>] strlen lib/string.c:481 [inline]
[<ffffffff81d21ce1>] strlcpy+0x101/0x120 lib/string.c:141
[<ffffffff83031762>] xt_copy_counters_from_user+0x152/0x2c0
net/netfilter/x_tables.c:793
[<ffffffff83269566>] do_add_counters+0x96/0x590
net/ipv6/netfilter/ip6_tables.c:1334
[<ffffffff8326f41f>] compat_do_ipt_set_ctl+0xbf/0x150
net/ipv4/netfilter/ip_tables.c:1725
[<ffffffff82f988a8>] compat_nf_sockopt net/netfilter/nf_sockopt.c:143
[inline]
[<ffffffff82f988a8>] compat_nf_setsockopt+0x88/0x130
net/netfilter/nf_sockopt.c:155
[<ffffffff830ffd1d>] compat_ip_setsockopt+0x9d/0xf0
net/ipv4/ip_sockglue.c:1255
[<ffffffff83108f05>] inet_csk_compat_setsockopt+0x95/0x120
net/ipv4/inet_connection_sock.c:914
[<ffffffff8311e78d>] compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2643
[<ffffffff82df3dd2>] compat_sock_common_setsockopt+0xb2/0x140
net/core/sock.c:2670
[<ffffffff82edb0a9>] C_SYSC_setsockopt net/compat.c:384 [inline]
[<ffffffff82edb0a9>] compat_SyS_setsockopt+0x149/0x290 net/compat.c:367
[<ffffffff81006d84>] do_syscall_32_irqs_on arch/x86/entry/common.c:390
[inline]
[<ffffffff81006d84>] do_fast_syscall_32+0x314/0x890
arch/x86/entry/common.c:457
[<ffffffff83776faa>] sysenter_flags_fixed+0xd/0x17

The buggy address belongs to the page:
page:ffffea00075d0bc0 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x8000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8801d742fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801d742fa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1
> ffff8801d742fb00: f1 f1 f1 00 00 00 00 04 f2 f2 f2 00 00 00 00 00
^
ffff8801d742fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801d742fc00: f1 f1 f1 f1 00 00 00 00 00 f2 f2 f2 00 00 00 00
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 06fe41f8
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=11b0a769800000
kernel config: https://syzkaller.appspot.com/x/.config?x=4fadd453521adb
dashboard link: https://syzkaller.appspot.com/bug?extid=c72cfdee740ef2dd5bbd

compiler: gcc (GCC) 7.1.1 20170620
userspace arch: i386

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e8f231800000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=128eae19800000

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+c72cfd...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: stack-out-of-bounds in strlen lib/string.c:481 [inline]
BUG: KASAN: stack-out-of-bounds in strlcpy+0x101/0x120 lib/string.c:141

Read of size 1 at addr ffff8801ca397b4c by task syzkaller680216/3319

CPU: 1 PID: 3319 Comm: syzkaller680216 Not tainted 4.9.75-g06fe41f #16

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011

ffff8801ca397a28 ffffffff81d93049 ffffea000728e5c0 ffff8801ca397b4c
0000000000000000 ffff8801ca397b4c ffff8801ca397c30 ffff8801ca397a60
ffffffff8153ca53 ffff8801ca397b4c 0000000000000001 0000000000000000
Call Trace:
[<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff8153ca53>] print_address_description+0x73/0x280
mm/kasan/report.c:252
[<ffffffff8153cf75>] kasan_report_error mm/kasan/report.c:351 [inline]
[<ffffffff8153cf75>] kasan_report+0x275/0x360 mm/kasan/report.c:408
[<ffffffff8153d074>] __asan_report_load1_noabort+0x14/0x20
mm/kasan/report.c:426
[<ffffffff81db1911>] strlen lib/string.c:481 [inline]
[<ffffffff81db1911>] strlcpy+0x101/0x120 lib/string.c:141
[<ffffffff8313b633>] xt_copy_counters_from_user+0x163/0x2e0
net/netfilter/x_tables.c:844
[<ffffffff8351a9b6>] do_add_counters+0x96/0x590
net/ipv6/netfilter/ip6_tables.c:1213
[<ffffffff83520b9f>] compat_do_ip6t_set_ctl+0xbf/0x150
net/ipv6/netfilter/ip6_tables.c:1588
[<ffffffff8309fbe8>] compat_nf_sockopt net/netfilter/nf_sockopt.c:143
[inline]
[<ffffffff8309fbe8>] compat_nf_setsockopt+0x88/0x130
net/netfilter/nf_sockopt.c:155
[<ffffffff83478b2a>] compat_ipv6_setsockopt+0x13a/0x1e0
net/ipv6/ipv6_sockglue.c:947
[<ffffffff83219205>] inet_csk_compat_setsockopt+0x95/0x120
net/ipv4/inet_connection_sock.c:914
[<ffffffff8322f5dd>] compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2748
[<ffffffff82edc362>] compat_sock_common_setsockopt+0xb2/0x140
net/core/sock.c:2717
[<ffffffff82fdbaa9>] C_SYSC_setsockopt net/compat.c:398 [inline]
[<ffffffff82fdbaa9>] compat_SyS_setsockopt+0x149/0x290 net/compat.c:381
[<ffffffff81006fc7>] do_syscall_32_irqs_on arch/x86/entry/common.c:322
[inline]
[<ffffffff81006fc7>] do_fast_syscall_32+0x2f7/0x890
arch/x86/entry/common.c:384
[<ffffffff838b2334>] entry_SYSENTER_compat+0x74/0x83
arch/x86/entry/entry_64_compat.S:127

The buggy address belongs to the page:

page:ffffea000728e5c0 count:0 mapcount:0 mapping: (null) index:0x0

flags: 0x8000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff8801ca397a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801ca397a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff8801ca397b00: 00 f1 f1 f1 f1 00 00 00 00 04 f2 f2 f2 00 00 00
^
ffff8801ca397b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801ca397c00: 00 00 f1 f1 f1 f1 00 00 00 00 00 f2 f2 f2 00 00