KASAN: use-after-free Read in tomoyo_socket_sendmsg_permission
7 views
Skip to first unread message
syzbot
Aug 8, 2019, 12:45:06 PM8/8/19
to jmo...@namei.org, linux-...@vger.kernel.org, linux-secu...@vger.kernel.org, net...@vger.kernel.org, se...@hallyn.com, syzkall...@googlegroups.com, take...@nttdata.co.jp
Hello,
syzbot found the following crash on:
HEAD commit: 107e47cc vrf: make sure skb->data contains ip header to ma..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=139506d8600000
kernel config: https://syzkaller.appspot.com/x/.config?x=4dba67bf8b8c9ad7
dashboard link: https://syzkaller.appspot.com/bug?extid=b91501546ab4037f685f
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+b91501...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in tomoyo_sock_family
security/tomoyo/network.c:632 [inline]
BUG: KASAN: use-after-free in tomoyo_socket_sendmsg_permission+0x37e/0x3cb
security/tomoyo/network.c:762
Read of size 2 at addr ffff8880a066f410 by task syz-executor.3/2063
CPU: 1 PID: 2063 Comm: syz-executor.3 Not tainted 5.2.0+ #97
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0xd4/0x306 mm/kasan/report.c:351
__kasan_report.cold+0x1b/0x36 mm/kasan/report.c:482
kasan_report+0x12/0x17 mm/kasan/common.c:612
__asan_report_load2_noabort+0x14/0x20 mm/kasan/generic_report.c:130
tomoyo_sock_family security/tomoyo/network.c:632 [inline]
tomoyo_socket_sendmsg_permission+0x37e/0x3cb security/tomoyo/network.c:762
tomoyo_socket_sendmsg+0x26/0x30 security/tomoyo/tomoyo.c:486
security_socket_sendmsg+0x77/0xc0 security/security.c:1973
sock_sendmsg+0x45/0x130 net/socket.c:654
__sys_sendto+0x262/0x380 net/socket.c:1952
__do_sys_sendto net/socket.c:1964 [inline]
__se_sys_sendto net/socket.c:1960 [inline]
__x64_sys_sendto+0xe1/0x1a0 net/socket.c:1960
do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459829
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8413a51c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459829
RDX: 00000000000000ed RSI: 0000000020000280 RDI: 0000000000000005
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8413a526d4
R13: 00000000004c77f1 R14: 00000000004dcfc0 R15: 00000000ffffffff
Allocated by task 0:
save_stack+0x23/0x90 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc mm/kasan/common.c:487 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:460
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:501
__do_kmalloc mm/slab.c:3655 [inline]
__kmalloc+0x163/0x770 mm/slab.c:3664
kmalloc include/linux/slab.h:557 [inline]
sk_prot_alloc+0x23a/0x310 net/core/sock.c:1603
sk_alloc+0x39/0xf70 net/core/sock.c:1657
nr_make_new net/netrom/af_netrom.c:476 [inline]
nr_rx_frame+0x733/0x1e73 net/netrom/af_netrom.c:959
nr_loopback_timer+0x7b/0x170 net/netrom/nr_loopback.c:59
call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1322
expire_timers kernel/time/timer.c:1366 [inline]
__run_timers kernel/time/timer.c:1685 [inline]
__run_timers kernel/time/timer.c:1653 [inline]
run_timer_softirq+0x697/0x17a0 kernel/time/timer.c:1698
__do_softirq+0x262/0x98c kernel/softirq.c:292
Freed by task 2063:
save_stack+0x23/0x90 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:449
kasan_slab_free+0xe/0x10 mm/kasan/common.c:457
__cache_free mm/slab.c:3425 [inline]
kfree+0x10a/0x2c0 mm/slab.c:3756
sk_prot_free net/core/sock.c:1640 [inline]
__sk_destruct+0x4f7/0x6e0 net/core/sock.c:1726
sk_destruct+0x86/0xa0 net/core/sock.c:1734
__sk_free+0xfb/0x360 net/core/sock.c:1745
sk_free+0x42/0x50 net/core/sock.c:1756
sock_put include/net/sock.h:1725 [inline]
sock_efree+0x61/0x80 net/core/sock.c:2042
skb_release_head_state+0xeb/0x250 net/core/skbuff.c:652
skb_release_all+0x16/0x60 net/core/skbuff.c:663
__kfree_skb net/core/skbuff.c:679 [inline]
kfree_skb net/core/skbuff.c:697 [inline]
kfree_skb+0x101/0x3c0 net/core/skbuff.c:691
nr_accept+0x56e/0x700 net/netrom/af_netrom.c:819
__sys_accept4+0x34e/0x6a0 net/socket.c:1754
__do_sys_accept net/socket.c:1795 [inline]
__se_sys_accept net/socket.c:1792 [inline]
__x64_sys_accept+0x75/0xb0 net/socket.c:1792
do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8880a066f400
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 16 bytes inside of
2048-byte region [ffff8880a066f400, ffff8880a066fc00)
The buggy address belongs to the page:
page:ffffea0002819b80 refcount:1 mapcount:0 mapping:ffff8880aa400e00
index:0x0 compound_mapcount: 0
flags: 0x1fffc0000010200(slab|head)
raw: 01fffc0000010200 ffffea0001849388 ffffea000235a788 ffff8880aa400e00
raw: 0000000000000000 ffff8880a066e300 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880a066f300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a066f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8880a066f400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a066f480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a066f500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 2063 at lib/refcount.c:105 refcount_add_checked
lib/refcount.c:105 [inline]
WARNING: CPU: 1 PID: 2063 at lib/refcount.c:105
refcount_add_checked+0x6b/0x70 lib/refcount.c:103
Modules linked in:
CPU: 1 PID: 2063 Comm: syz-executor.3 Tainted: G B 5.2.0+ #97
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:refcount_add_checked lib/refcount.c:105 [inline]
RIP: 0010:refcount_add_checked+0x6b/0x70 lib/refcount.c:103
Code: 1d e7 77 64 06 31 ff 89 de e8 71 dc 35 fe 84 db 75 db e8 28 db 35 fe
48 c7 c7 20 08 c6 87 c6 05 c7 77 64 06 01 e8 1d 43 07 fe <0f> 0b eb bf 90
48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 54 49
RSP: 0018:ffff88805d55f9f8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000040000 RSI: ffffffff815c3a26 RDI: ffffed100baabf31
RBP: ffff88805d55fa10 R08: ffff888098124480 R09: fffffbfff1349ef0
R10: fffffbfff1349eef R11: ffffffff89a4f77f R12: 0000000000000500
R13: ffff8880a066f644 R14: ffff88808f271e60 R15: 00000000000000ed
FS: 00007f8413a52700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000075c000 CR3: 0000000097173000 CR4: 00000000001406e0
Call Trace:
skb_set_owner_w+0x216/0x320 net/core/sock.c:1991
sock_alloc_send_pskb+0x7c9/0x920 net/core/sock.c:2226
sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2240
nr_sendmsg+0x557/0xb00 net/netrom/af_netrom.c:1094
sock_sendmsg_nosec net/socket.c:637 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:657
__sys_sendto+0x262/0x380 net/socket.c:1952
__do_sys_sendto net/socket.c:1964 [inline]
__se_sys_sendto net/socket.c:1960 [inline]
__x64_sys_sendto+0xe1/0x1a0 net/socket.c:1960
do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459829
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8413a51c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459829
RDX: 00000000000000ed RSI: 0000000020000280 RDI: 0000000000000005
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8413a526d4
R13: 00000000004c77f1 R14: 00000000004dcfc0 R15: 00000000ffffffff
irq event stamp: 344
hardirqs last enabled at (343): [<ffffffff8100a206>]
do_syscall_64+0x26/0x6a0 arch/x86/entry/common.c:283
hardirqs last disabled at (344): [<ffffffff87391ddf>]
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (344): [<ffffffff87391ddf>]
_raw_spin_lock_irqsave+0x6f/0xcd kernel/locking/spinlock.c:159
softirqs last enabled at (314): [<ffffffff858fb1b6>] spin_unlock_bh
include/linux/spinlock.h:383 [inline]
softirqs last enabled at (314): [<ffffffff858fb1b6>]
release_sock+0x156/0x1c0 net/core/sock.c:2945
softirqs last disabled at (312): [<ffffffff858fb080>] spin_lock_bh
include/linux/spinlock.h:343 [inline]
softirqs last disabled at (312): [<ffffffff858fb080>]
release_sock+0x20/0x1c0 net/core/sock.c:2932
---[ end trace 2fe47c842e5d598a ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 107e47cc vrf: make sure skb->data contains ip header to ma..
git tree: net
console output: https://syzkaller.appspot.com/x/log.txt?x=139506d8600000
kernel config: https://syzkaller.appspot.com/x/.config?x=4dba67bf8b8c9ad7
dashboard link: https://syzkaller.appspot.com/bug?extid=b91501546ab4037f685f
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+b91501...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in tomoyo_sock_family
security/tomoyo/network.c:632 [inline]
BUG: KASAN: use-after-free in tomoyo_socket_sendmsg_permission+0x37e/0x3cb
security/tomoyo/network.c:762
Read of size 2 at addr ffff8880a066f410 by task syz-executor.3/2063
CPU: 1 PID: 2063 Comm: syz-executor.3 Not tainted 5.2.0+ #97
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0xd4/0x306 mm/kasan/report.c:351
__kasan_report.cold+0x1b/0x36 mm/kasan/report.c:482
kasan_report+0x12/0x17 mm/kasan/common.c:612
__asan_report_load2_noabort+0x14/0x20 mm/kasan/generic_report.c:130
tomoyo_sock_family security/tomoyo/network.c:632 [inline]
tomoyo_socket_sendmsg_permission+0x37e/0x3cb security/tomoyo/network.c:762
tomoyo_socket_sendmsg+0x26/0x30 security/tomoyo/tomoyo.c:486
security_socket_sendmsg+0x77/0xc0 security/security.c:1973
sock_sendmsg+0x45/0x130 net/socket.c:654
__sys_sendto+0x262/0x380 net/socket.c:1952
__do_sys_sendto net/socket.c:1964 [inline]
__se_sys_sendto net/socket.c:1960 [inline]
__x64_sys_sendto+0xe1/0x1a0 net/socket.c:1960
do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459829
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8413a51c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459829
RDX: 00000000000000ed RSI: 0000000020000280 RDI: 0000000000000005
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8413a526d4
R13: 00000000004c77f1 R14: 00000000004dcfc0 R15: 00000000ffffffff
Allocated by task 0:
save_stack+0x23/0x90 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc mm/kasan/common.c:487 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:460
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:501
__do_kmalloc mm/slab.c:3655 [inline]
__kmalloc+0x163/0x770 mm/slab.c:3664
kmalloc include/linux/slab.h:557 [inline]
sk_prot_alloc+0x23a/0x310 net/core/sock.c:1603
sk_alloc+0x39/0xf70 net/core/sock.c:1657
nr_make_new net/netrom/af_netrom.c:476 [inline]
nr_rx_frame+0x733/0x1e73 net/netrom/af_netrom.c:959
nr_loopback_timer+0x7b/0x170 net/netrom/nr_loopback.c:59
call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1322
expire_timers kernel/time/timer.c:1366 [inline]
__run_timers kernel/time/timer.c:1685 [inline]
__run_timers kernel/time/timer.c:1653 [inline]
run_timer_softirq+0x697/0x17a0 kernel/time/timer.c:1698
__do_softirq+0x262/0x98c kernel/softirq.c:292
Freed by task 2063:
save_stack+0x23/0x90 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:449
kasan_slab_free+0xe/0x10 mm/kasan/common.c:457
__cache_free mm/slab.c:3425 [inline]
kfree+0x10a/0x2c0 mm/slab.c:3756
sk_prot_free net/core/sock.c:1640 [inline]
__sk_destruct+0x4f7/0x6e0 net/core/sock.c:1726
sk_destruct+0x86/0xa0 net/core/sock.c:1734
__sk_free+0xfb/0x360 net/core/sock.c:1745
sk_free+0x42/0x50 net/core/sock.c:1756
sock_put include/net/sock.h:1725 [inline]
sock_efree+0x61/0x80 net/core/sock.c:2042
skb_release_head_state+0xeb/0x250 net/core/skbuff.c:652
skb_release_all+0x16/0x60 net/core/skbuff.c:663
__kfree_skb net/core/skbuff.c:679 [inline]
kfree_skb net/core/skbuff.c:697 [inline]
kfree_skb+0x101/0x3c0 net/core/skbuff.c:691
nr_accept+0x56e/0x700 net/netrom/af_netrom.c:819
__sys_accept4+0x34e/0x6a0 net/socket.c:1754
__do_sys_accept net/socket.c:1795 [inline]
__se_sys_accept net/socket.c:1792 [inline]
__x64_sys_accept+0x75/0xb0 net/socket.c:1792
do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8880a066f400
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 16 bytes inside of
2048-byte region [ffff8880a066f400, ffff8880a066fc00)
The buggy address belongs to the page:
page:ffffea0002819b80 refcount:1 mapcount:0 mapping:ffff8880aa400e00
index:0x0 compound_mapcount: 0
flags: 0x1fffc0000010200(slab|head)
raw: 01fffc0000010200 ffffea0001849388 ffffea000235a788 ffff8880aa400e00
raw: 0000000000000000 ffff8880a066e300 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880a066f300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a066f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8880a066f400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880a066f480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880a066f500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 2063 at lib/refcount.c:105 refcount_add_checked
lib/refcount.c:105 [inline]
WARNING: CPU: 1 PID: 2063 at lib/refcount.c:105
refcount_add_checked+0x6b/0x70 lib/refcount.c:103
Modules linked in:
CPU: 1 PID: 2063 Comm: syz-executor.3 Tainted: G B 5.2.0+ #97
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:refcount_add_checked lib/refcount.c:105 [inline]
RIP: 0010:refcount_add_checked+0x6b/0x70 lib/refcount.c:103
Code: 1d e7 77 64 06 31 ff 89 de e8 71 dc 35 fe 84 db 75 db e8 28 db 35 fe
48 c7 c7 20 08 c6 87 c6 05 c7 77 64 06 01 e8 1d 43 07 fe <0f> 0b eb bf 90
48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 54 49
RSP: 0018:ffff88805d55f9f8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000040000 RSI: ffffffff815c3a26 RDI: ffffed100baabf31
RBP: ffff88805d55fa10 R08: ffff888098124480 R09: fffffbfff1349ef0
R10: fffffbfff1349eef R11: ffffffff89a4f77f R12: 0000000000000500
R13: ffff8880a066f644 R14: ffff88808f271e60 R15: 00000000000000ed
FS: 00007f8413a52700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000075c000 CR3: 0000000097173000 CR4: 00000000001406e0
Call Trace:
skb_set_owner_w+0x216/0x320 net/core/sock.c:1991
sock_alloc_send_pskb+0x7c9/0x920 net/core/sock.c:2226
sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2240
nr_sendmsg+0x557/0xb00 net/netrom/af_netrom.c:1094
sock_sendmsg_nosec net/socket.c:637 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:657
__sys_sendto+0x262/0x380 net/socket.c:1952
__do_sys_sendto net/socket.c:1964 [inline]
__se_sys_sendto net/socket.c:1960 [inline]
__x64_sys_sendto+0xe1/0x1a0 net/socket.c:1960
do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459829
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8413a51c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459829
RDX: 00000000000000ed RSI: 0000000020000280 RDI: 0000000000000005
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8413a526d4
R13: 00000000004c77f1 R14: 00000000004dcfc0 R15: 00000000ffffffff
irq event stamp: 344
hardirqs last enabled at (343): [<ffffffff8100a206>]
do_syscall_64+0x26/0x6a0 arch/x86/entry/common.c:283
hardirqs last disabled at (344): [<ffffffff87391ddf>]
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (344): [<ffffffff87391ddf>]
_raw_spin_lock_irqsave+0x6f/0xcd kernel/locking/spinlock.c:159
softirqs last enabled at (314): [<ffffffff858fb1b6>] spin_unlock_bh
include/linux/spinlock.h:383 [inline]
softirqs last enabled at (314): [<ffffffff858fb1b6>]
release_sock+0x156/0x1c0 net/core/sock.c:2945
softirqs last disabled at (312): [<ffffffff858fb080>] spin_lock_bh
include/linux/spinlock.h:343 [inline]
softirqs last disabled at (312): [<ffffffff858fb080>]
release_sock+0x20/0x1c0 net/core/sock.c:2932
---[ end trace 2fe47c842e5d598a ]---
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
Tetsuo Handa
Aug 8, 2019, 6:08:23 PM8/8/19
to syzbot, syzkall...@googlegroups.com, Ralf Baechle, linux...@vger.kernel.org, linux-...@vger.kernel.org, net...@vger.kernel.org
On 2019/08/09 1:45, syzbot wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 107e47cc vrf: make sure skb->data contains ip header to ma..
> git tree: net
> console output: https://syzkaller.appspot.com/x/log.txt?x=139506d8600000
> kernel config: https://syzkaller.appspot.com/x/.config?x=4dba67bf8b8c9ad7
> dashboard link: https://syzkaller.appspot.com/bug?extid=b91501546ab4037f685f
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
This is not TOMOYO's bug. LSM modules expect that "struct sock" does not go away.
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 107e47cc vrf: make sure skb->data contains ip header to ma..
> git tree: net
> console output: https://syzkaller.appspot.com/x/log.txt?x=139506d8600000
> kernel config: https://syzkaller.appspot.com/x/.config?x=4dba67bf8b8c9ad7
> dashboard link: https://syzkaller.appspot.com/bug?extid=b91501546ab4037f685f
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
Also, another use-after-free (presumably on the same "struct sock") was concurrently
inflight at nr_insert_socket() in net/netrom/af_netrom.c . Thus, suspecting netrom's bug.
[ 625.441058][ C0] ------------[ cut here ]------------
[ 625.446837][ C0] refcount_t: increment on 0; use-after-free.
[ 625.461518][ C0] WARNING: CPU: 0 PID: 0 at lib/refcount.c:156 refcount_inc_checked+0x61/0x70
[ 625.479173][ C0] Kernel panic - not syncing: panic_on_warn set ...
[ 625.746558][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.2.0+ #97
[ 625.746575][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 625.755731][ C0] Call Trace:
[ 625.770091][ C0] <IRQ>
[ 625.777543][ C0] dump_stack+0x172/0x1f0
[ 625.786005][ C0] ? refcount_inc_not_zero_checked+0x1f0/0x200
[ 625.794831][ C0] panic+0x2dc/0x755
[ 625.805217][ C0] ? add_taint.cold+0x16/0x16
[ 625.813697][ C0] ? __kasan_check_write+0x14/0x20
[ 625.822433][ C0] ? __warn.cold+0x5/0x4c
[ 625.832388][ C0] ? __warn+0xe7/0x1e0
[ 625.841820][ C0] ? refcount_inc_checked+0x61/0x70
[ 625.851148][ C0] __warn.cold+0x20/0x4c
[ 625.859701][ C0] ? vprintk_emit+0x1ea/0x700
[ 625.867208][ C0] ? refcount_inc_checked+0x61/0x70
[ 625.875413][ C0] report_bug+0x263/0x2b0
[ 625.884580][ C0] do_error_trap+0x11b/0x200
[ 625.893730][ C0] do_invalid_op+0x37/0x50
[ 625.902936][ C0] ? refcount_inc_checked+0x61/0x70
[ 625.911858][ C0] invalid_op+0x14/0x20
[ 625.920825][ C0] RIP: 0010:refcount_inc_checked+0x61/0x70
[ 625.929407][ C0] Code: 1d 3f 6e 64 06 31 ff 89 de e8 cb d2 35 fe 84 db 75 dd e8 82 d1 35 fe 48 c7 c7 40 09 c6 87 c6 05 1f 6e 64 06 01 e8 77 39 07 fe <0f> 0b eb c1 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 41 57 41
[ 625.937608][ C0] RSP: 0018:ffff8880ae809bf0 EFLAGS: 00010282
[ 625.948510][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 625.957237][ C0] RDX: 0000000000000100 RSI: ffffffff815c3a26 RDI: ffffed1015d01370
[ 625.967249][ C0] RBP: ffff8880ae809c00 R08: ffffffff88c7a1c0 R09: fffffbfff14a775b
[ 625.991542][ C0] R10: fffffbfff14a775a R11: ffffffff8a53bad7 R12: ffff8880a066f480
[ 626.002193][ C0] R13: ffff8880a066f468 R14: ffff88808d69ef48 R15: ffff88808d69ef20
[ 626.014844][ C0] ? vprintk_func+0x86/0x189
[ 626.027298][ C0] nr_insert_socket+0x2d/0xe0
[ 626.041237][ C0] nr_rx_frame+0x1605/0x1e73
[ 626.051737][ C0] nr_loopback_timer+0x7b/0x170
[ 626.073842][ C0] call_timer_fn+0x1ac/0x780
[ 626.092970][ C0] ? nr_process_rx_frame+0x1540/0x1540
[ 626.108552][ C0] ? msleep_interruptible+0x150/0x150
[ 626.118574][ C0] ? run_timer_softirq+0x685/0x17a0
[ 626.131811][ C0] ? trace_hardirqs_on+0x67/0x240
[ 626.145424][ C0] ? __kasan_check_read+0x11/0x20
[ 626.156592][ C0] ? nr_process_rx_frame+0x1540/0x1540
[ 626.164362][ C0] ? nr_process_rx_frame+0x1540/0x1540
[ 626.175423][ C0] run_timer_softirq+0x697/0x17a0
[ 626.188804][ C0] ? add_timer+0x930/0x930
[ 626.202652][ C0] ? kvm_clock_read+0x18/0x30
[ 626.215813][ C0] ? kvm_sched_clock_read+0x9/0x20
[ 626.231378][ C0] ? sched_clock+0x2e/0x50
[ 626.231395][ C0] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 626.231408][ C0] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 626.231432][ C0] __do_softirq+0x262/0x98c
[ 626.244512][ C0] ? sched_clock_cpu+0x1b/0x1b0
[ 626.244531][ C0] irq_exit+0x19b/0x1e0
[ 626.244545][ C0] smp_apic_timer_interrupt+0x1a3/0x610
[ 626.244558][ C0] apic_timer_interrupt+0xf/0x20
[ 626.244563][ C0] </IRQ>
[ 626.244579][ C0] RIP: 0010:native_safe_halt+0xe/0x10
[ 626.244606][ C0] Code: b8 94 73 fa eb 8a 90 90 90 90 90 90 e9 07 00 00 00 0f 00 2d 34 25 4f 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 24 25 4f 00 fb f4 <c3> 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 e8 0e 56 27 fa e8 c9
[ 626.257081][ C0] RSP: 0018:ffffffff88c07ce8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
[ 626.269812][ C0] RAX: 1ffffffff11a5e05 RBX: ffffffff88c7a1c0 RCX: 0000000000000000
[ 626.281053][ C0] RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffffffff88c7aa4c
[ 626.290913][ C0] RBP: ffffffff88c07d18 R08: ffffffff88c7a1c0 R09: 0000000000000000
[ 626.303361][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
[ 626.314081][ C0] R13: ffffffff89a4f778 R14: 0000000000000000 R15: 0000000000000000
[ 626.314116][ C0] ? default_idle+0x4e/0x360
[ 626.323075][ C0] arch_cpu_idle+0xa/0x10
[ 626.333543][ C0] default_idle_call+0x84/0xb0
[ 626.341839][ C0] do_idle+0x413/0x760
[ 626.370736][ C0] ? retint_kernel+0x2b/0x2b
[ 626.383044][ C0] ? arch_cpu_idle_exit+0x80/0x80
[ 626.400071][ C0] ? do_idle+0x387/0x760
[ 626.418085][ C0] cpu_startup_entry+0x1b/0x20
[ 626.431835][ C0] rest_init+0x245/0x37b
[ 626.459420][ C0] arch_call_rest_init+0xe/0x1b
[ 626.471993][ C0] start_kernel+0x912/0x951
[ 626.482387][ C0] ? mem_encrypt_init+0xb/0xb
[ 626.495105][ C0] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 626.507125][ C0] ? x86_family+0x41/0x50
[ 626.519773][ C0] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 626.532837][ C0] x86_64_start_reservations+0x29/0x2b
[ 626.545019][ C0] x86_64_start_kernel+0x77/0x7b
[ 626.558711][ C0] secondary_startup_64+0xa4/0xb0
[ 626.897092][ C0] Kernel Offset: disabled
[ 626.901428][ C0] Rebooting in 86400 seconds..
Dmitry Vyukov
Aug 9, 2019, 4:53:58 AM8/9/19
to Tetsuo Handa, syzbot, syzkaller-bugs, Ralf Baechle, linux-hams, LKML, netdev, Cong Wang
On Fri, Aug 9, 2019 at 12:08 AM Tetsuo Handa
<penguin...@i-love.sakura.ne.jp> wrote:
>
> On 2019/08/09 1:45, syzbot wrote:
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit: 107e47cc vrf: make sure skb->data contains ip header to ma..
> > git tree: net
> > console output: https://syzkaller.appspot.com/x/log.txt?x=139506d8600000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=4dba67bf8b8c9ad7
> > dashboard link: https://syzkaller.appspot.com/bug?extid=b91501546ab4037f685f
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
>
> This is not TOMOYO's bug. LSM modules expect that "struct sock" does not go away.
>
> Also, another use-after-free (presumably on the same "struct sock") was concurrently
> inflight at nr_insert_socket() in net/netrom/af_netrom.c . Thus, suspecting netrom's bug.
There is a number of UAFs/refcount bugs in nr sockets lately. Most
<penguin...@i-love.sakura.ne.jp> wrote:
>
> On 2019/08/09 1:45, syzbot wrote:
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit: 107e47cc vrf: make sure skb->data contains ip header to ma..
> > git tree: net
> > console output: https://syzkaller.appspot.com/x/log.txt?x=139506d8600000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=4dba67bf8b8c9ad7
> > dashboard link: https://syzkaller.appspot.com/bug?extid=b91501546ab4037f685f
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
>
> This is not TOMOYO's bug. LSM modules expect that "struct sock" does not go away.
>
> Also, another use-after-free (presumably on the same "struct sock") was concurrently
> inflight at nr_insert_socket() in net/netrom/af_netrom.c . Thus, suspecting netrom's bug.
likely it's the same issue them. Most of them were bisected to:
commit c8c8218ec5af5d2598381883acbefbf604e56b5e
Date: Thu Jun 27 21:30:58 2019 +0000
netrom: fix a memory leak in nr_rx_frame()
+Cong
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/4616850c-bf9e-d32a-3cfb-dbbaec5e17f2%40I-love.SAKURA.ne.jp.
Cong Wang
Aug 9, 2019, 1:29:12 PM8/9/19
to Dmitry Vyukov, Tetsuo Handa, syzbot, syzkaller-bugs, Ralf Baechle, linux-hams, LKML, netdev
On Fri, Aug 9, 2019 at 1:53 AM Dmitry Vyukov <dvy...@google.com> wrote:
>
> On Fri, Aug 9, 2019 at 12:08 AM Tetsuo Handa
> <penguin...@i-love.sakura.ne.jp> wrote:
> >
> > On 2019/08/09 1:45, syzbot wrote:
> > > Hello,
> > >
> > > syzbot found the following crash on:
> > >
> > > HEAD commit: 107e47cc vrf: make sure skb->data contains ip header to ma..
> > > git tree: net
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=139506d8600000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=4dba67bf8b8c9ad7
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=b91501546ab4037f685f
> > > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> >
> > This is not TOMOYO's bug. LSM modules expect that "struct sock" does not go away.
> >
> > Also, another use-after-free (presumably on the same "struct sock") was concurrently
> > inflight at nr_insert_socket() in net/netrom/af_netrom.c . Thus, suspecting netrom's bug.
>
> There is a number of UAFs/refcount bugs in nr sockets lately. Most
> likely it's the same issue them. Most of them were bisected to:
>
> commit c8c8218ec5af5d2598381883acbefbf604e56b5e
> Date: Thu Jun 27 21:30:58 2019 +0000
> netrom: fix a memory leak in nr_rx_frame()
The UAF introduced by this commit has been fixed. There is
>
> On Fri, Aug 9, 2019 at 12:08 AM Tetsuo Handa
> <penguin...@i-love.sakura.ne.jp> wrote:
> >
> > On 2019/08/09 1:45, syzbot wrote:
> > > Hello,
> > >
> > > syzbot found the following crash on:
> > >
> > > HEAD commit: 107e47cc vrf: make sure skb->data contains ip header to ma..
> > > git tree: net
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=139506d8600000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=4dba67bf8b8c9ad7
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=b91501546ab4037f685f
> > > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> >
> > This is not TOMOYO's bug. LSM modules expect that "struct sock" does not go away.
> >
> > Also, another use-after-free (presumably on the same "struct sock") was concurrently
> > inflight at nr_insert_socket() in net/netrom/af_netrom.c . Thus, suspecting netrom's bug.
>
> There is a number of UAFs/refcount bugs in nr sockets lately. Most
> likely it's the same issue them. Most of them were bisected to:
>
> commit c8c8218ec5af5d2598381883acbefbf604e56b5e
> Date: Thu Jun 27 21:30:58 2019 +0000
> netrom: fix a memory leak in nr_rx_frame()
another UAF in netrom which exists long before the above commit,
it is not fixed. The last time I looked at it, it seems related to the
state machine used by netrom sockets, so it is not easy.
Thanks,
syzbot
Nov 27, 2019, 10:19:05 PM11/27/19
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages