KASAN: use-after-free Read in tls_write_space
13 views
Skip to first unread message
syzbot
Apr 14, 2019, 5:26:05 PM4/14/19
to syzkaller...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 4d552acf Linux 4.19.34
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1542b07b200000
kernel config: https://syzkaller.appspot.com/x/.config?x=c95a88291f095edd
dashboard link: https://syzkaller.appspot.com/bug?extid=3e993c7003fc297efdbe
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1634f387200000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3e993c...@syzkaller.appspotmail.com
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending
cookies. Check SNMP counters.
net_ratelimit: 26 callbacks suppressed
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending
cookies. Check SNMP counters.
==================================================================
BUG: KASAN: use-after-free in tls_write_space+0x2b8/0x310
net/tls/tls_main.c:220
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending
cookies. Check SNMP counters.
Read of size 1 at addr ffff88809bd72ba0 by task syz-executor.3/12718
CPU: 0 PID: 12718 Comm: syz-executor.3 Not tainted 4.19.34 #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
__asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
tls_write_space+0x2b8/0x310 net/tls/tls_main.c:220
tcp_new_space net/ipv4/tcp_input.c:5141 [inline]
tcp_check_space+0x435/0x730 net/ipv4/tcp_input.c:5152
tcp_data_snd_check net/ipv4/tcp_input.c:5162 [inline]
tcp_rcv_established+0x9f0/0x1f20 net/ipv4/tcp_input.c:5653
tcp_v6_do_rcv+0x4b3/0x13c0 net/ipv6/tcp_ipv6.c:1326
tcp_v6_rcv+0x2b9b/0x3520 net/ipv6/tcp_ipv6.c:1555
ip6_input_finish+0x374/0x1810 net/ipv6/ip6_input.c:383
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:426
dst_input include/net/dst.h:450 [inline]
ip6_rcv_finish+0x1e7/0x320 net/ipv6/ip6_input.c:76
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ipv6_rcv+0x119/0x430 net/ipv6/ip6_input.c:271
__netif_receive_skb_one_core+0x115/0x1a0 net/core/dev.c:4918
__netif_receive_skb+0x2c/0x1d0 net/core/dev.c:5028
process_backlog+0x206/0x750 net/core/dev.c:5839
napi_poll net/core/dev.c:6262 [inline]
net_rx_action+0x4fa/0x1070 net/core/dev.c:6328
__do_softirq+0x266/0x92f kernel/softirq.c:292
do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1051
</IRQ>
do_softirq.part.0+0x11a/0x170 kernel/softirq.c:336
do_softirq kernel/softirq.c:328 [inline]
__local_bh_enable_ip+0x211/0x270 kernel/softirq.c:189
__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline]
_raw_spin_unlock_bh+0x31/0x40 kernel/locking/spinlock.c:200
spin_unlock_bh include/linux/spinlock.h:374 [inline]
release_sock+0x158/0x1c0 net/core/sock.c:2864
tls_sk_proto_close+0x69b/0xaa0 net/tls/tls_main.c:312
inet_release+0x105/0x1f0 net/ipv4/af_inet.c:428
inet6_release+0x53/0x80 net/ipv6/af_inet6.c:472
__sock_release+0xd3/0x2b0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2df/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x14a/0x1c0 kernel/task_work.c:113
get_signal+0x1961/0x1d50 kernel/signal.c:2385
do_signal+0x95/0x1950 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458c29
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f2885952c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: 00000000003446e0 RBX: 0000000000000006 RCX: 0000000000458c29
RDX: fffffffffffffd47 RSI: 00000000200005c0 RDI: 0000000000000005
RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f28859536d4
R13: 00000000004c659f R14: 00000000004daf70 R15: 00000000ffffffff
Allocated by task 12718:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kmem_cache_alloc_trace+0x152/0x760 mm/slab.c:3625
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
create_ctx+0x46/0x1f0 net/tls/tls_main.c:553
tls_init+0x15b/0x7a0 net/tls/tls_main.c:686
tcp_set_ulp+0x21c/0x600 net/ipv4/tcp_ulp.c:155
do_tcp_setsockopt.isra.0+0x327/0x2330 net/ipv4/tcp.c:2750
tcp_setsockopt+0xc4/0xf0 net/ipv4/tcp.c:3064
sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3044
__sys_setsockopt+0x180/0x280 net/socket.c:1901
__do_sys_setsockopt net/socket.c:1912 [inline]
__se_sys_setsockopt net/socket.c:1909 [inline]
__x64_sys_setsockopt+0xbe/0x150 net/socket.c:1909
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 12718:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kfree+0xcf/0x230 mm/slab.c:3822
tls_ctx_free.part.0+0x32/0x40 net/tls/tls_main.c:251
tls_ctx_free net/tls/tls_main.c:246 [inline]
tls_sk_proto_close+0x68e/0xaa0 net/tls/tls_main.c:307
inet_release+0x105/0x1f0 net/ipv4/af_inet.c:428
inet6_release+0x53/0x80 net/ipv6/af_inet6.c:472
__sock_release+0xd3/0x2b0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2df/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x14a/0x1c0 kernel/task_work.c:113
get_signal+0x1961/0x1d50 kernel/signal.c:2385
do_signal+0x95/0x1950 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88809bd72ac0
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 224 bytes inside of
512-byte region [ffff88809bd72ac0, ffff88809bd72cc0)
The buggy address belongs to the page:
page:ffffea00026f5c80 count:1 mapcount:0 mapping:ffff88812c3f0940
index:0xffff88809bd72840
flags: 0x1fffc0000000100(slab)
raw: 01fffc0000000100 ffffea0002808e48 ffffea0002a62508 ffff88812c3f0940
raw: ffff88809bd72840 ffff88809bd720c0 0000000100000005 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809bd72a80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff88809bd72b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff88809bd72b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809bd72c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809bd72c80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following crash on:
HEAD commit: 4d552acf Linux 4.19.34
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1542b07b200000
kernel config: https://syzkaller.appspot.com/x/.config?x=c95a88291f095edd
dashboard link: https://syzkaller.appspot.com/bug?extid=3e993c7003fc297efdbe
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1634f387200000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3e993c...@syzkaller.appspotmail.com
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending
cookies. Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending
cookies. Check SNMP counters.
net_ratelimit: 26 callbacks suppressed
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending
cookies. Check SNMP counters.
==================================================================
BUG: KASAN: use-after-free in tls_write_space+0x2b8/0x310
net/tls/tls_main.c:220
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending
cookies. Check SNMP counters.
Read of size 1 at addr ffff88809bd72ba0 by task syz-executor.3/12718
CPU: 0 PID: 12718 Comm: syz-executor.3 Not tainted 4.19.34 #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
__asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
tls_write_space+0x2b8/0x310 net/tls/tls_main.c:220
tcp_new_space net/ipv4/tcp_input.c:5141 [inline]
tcp_check_space+0x435/0x730 net/ipv4/tcp_input.c:5152
tcp_data_snd_check net/ipv4/tcp_input.c:5162 [inline]
tcp_rcv_established+0x9f0/0x1f20 net/ipv4/tcp_input.c:5653
tcp_v6_do_rcv+0x4b3/0x13c0 net/ipv6/tcp_ipv6.c:1326
tcp_v6_rcv+0x2b9b/0x3520 net/ipv6/tcp_ipv6.c:1555
ip6_input_finish+0x374/0x1810 net/ipv6/ip6_input.c:383
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:426
dst_input include/net/dst.h:450 [inline]
ip6_rcv_finish+0x1e7/0x320 net/ipv6/ip6_input.c:76
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ipv6_rcv+0x119/0x430 net/ipv6/ip6_input.c:271
__netif_receive_skb_one_core+0x115/0x1a0 net/core/dev.c:4918
__netif_receive_skb+0x2c/0x1d0 net/core/dev.c:5028
process_backlog+0x206/0x750 net/core/dev.c:5839
napi_poll net/core/dev.c:6262 [inline]
net_rx_action+0x4fa/0x1070 net/core/dev.c:6328
__do_softirq+0x266/0x92f kernel/softirq.c:292
do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1051
</IRQ>
do_softirq.part.0+0x11a/0x170 kernel/softirq.c:336
do_softirq kernel/softirq.c:328 [inline]
__local_bh_enable_ip+0x211/0x270 kernel/softirq.c:189
__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline]
_raw_spin_unlock_bh+0x31/0x40 kernel/locking/spinlock.c:200
spin_unlock_bh include/linux/spinlock.h:374 [inline]
release_sock+0x158/0x1c0 net/core/sock.c:2864
tls_sk_proto_close+0x69b/0xaa0 net/tls/tls_main.c:312
inet_release+0x105/0x1f0 net/ipv4/af_inet.c:428
inet6_release+0x53/0x80 net/ipv6/af_inet6.c:472
__sock_release+0xd3/0x2b0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2df/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x14a/0x1c0 kernel/task_work.c:113
get_signal+0x1961/0x1d50 kernel/signal.c:2385
do_signal+0x95/0x1950 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458c29
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f2885952c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: 00000000003446e0 RBX: 0000000000000006 RCX: 0000000000458c29
RDX: fffffffffffffd47 RSI: 00000000200005c0 RDI: 0000000000000005
RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f28859536d4
R13: 00000000004c659f R14: 00000000004daf70 R15: 00000000ffffffff
Allocated by task 12718:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kmem_cache_alloc_trace+0x152/0x760 mm/slab.c:3625
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
create_ctx+0x46/0x1f0 net/tls/tls_main.c:553
tls_init+0x15b/0x7a0 net/tls/tls_main.c:686
tcp_set_ulp+0x21c/0x600 net/ipv4/tcp_ulp.c:155
do_tcp_setsockopt.isra.0+0x327/0x2330 net/ipv4/tcp.c:2750
tcp_setsockopt+0xc4/0xf0 net/ipv4/tcp.c:3064
sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3044
__sys_setsockopt+0x180/0x280 net/socket.c:1901
__do_sys_setsockopt net/socket.c:1912 [inline]
__se_sys_setsockopt net/socket.c:1909 [inline]
__x64_sys_setsockopt+0xbe/0x150 net/socket.c:1909
do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 12718:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kfree+0xcf/0x230 mm/slab.c:3822
tls_ctx_free.part.0+0x32/0x40 net/tls/tls_main.c:251
tls_ctx_free net/tls/tls_main.c:246 [inline]
tls_sk_proto_close+0x68e/0xaa0 net/tls/tls_main.c:307
inet_release+0x105/0x1f0 net/ipv4/af_inet.c:428
inet6_release+0x53/0x80 net/ipv6/af_inet6.c:472
__sock_release+0xd3/0x2b0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2df/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x14a/0x1c0 kernel/task_work.c:113
get_signal+0x1961/0x1d50 kernel/signal.c:2385
do_signal+0x95/0x1950 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88809bd72ac0
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 224 bytes inside of
512-byte region [ffff88809bd72ac0, ffff88809bd72cc0)
The buggy address belongs to the page:
page:ffffea00026f5c80 count:1 mapcount:0 mapping:ffff88812c3f0940
index:0xffff88809bd72840
flags: 0x1fffc0000000100(slab)
raw: 01fffc0000000100 ffffea0002808e48 ffffea0002a62508 ffff88812c3f0940
raw: ffff88809bd72840 ffff88809bd720c0 0000000100000005 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809bd72a80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff88809bd72b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff88809bd72b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809bd72c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809bd72c80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Jun 5, 2019, 2:49:06 PM6/5/19
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: e109a984 Linux 4.19.48
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17be54d4a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=2d14dd88554f26bc
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=106fd27ca00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3e993c...@syzkaller.appspotmail.com
RDX: 000000000000fdef RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000000004 R08: 0000000000000001 R09: 00007fff6d160033
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401ec0
R13: 0000000000401f50 R14: 0000000000000000 R15: 0000000000000000
==================================================================
BUG: KASAN: use-after-free in tls_write_space+0x2b2/0x310
net/tls/tls_main.c:220
Read of size 1 at addr ffff88809ecae8a0 by task syz-executor758/8044
CPU: 1 PID: 8044 Comm: syz-executor758 Not tainted 4.19.48 #20
tcp_new_space net/ipv4/tcp_input.c:5141 [inline]
tcp_check_space+0x430/0x720 net/ipv4/tcp_input.c:5152
tcp_data_snd_check net/ipv4/tcp_input.c:5162 [inline]
tcp_rcv_established+0x9e9/0x1f10 net/ipv4/tcp_input.c:5653
tcp_v4_do_rcv+0x616/0x8d0 net/ipv4/tcp_ipv4.c:1535
sk_backlog_rcv include/net/sock.h:941 [inline]
__release_sock+0x129/0x3a0 net/core/sock.c:2337
release_sock+0x59/0x1c0 net/core/sock.c:2853
tls_sk_proto_close+0x691/0xa20 net/tls/tls_main.c:309
inet_release+0xff/0x1e0 net/ipv4/af_inet.c:428
__sock_release+0x1f4/0x2a0 net/socket.c:579
sock_release+0x18/0x20 net/socket.c:599
smc_release+0x2c1/0x810 net/smc/af_smc.c:156
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x933/0x2fa0 kernel/exit.c:876
do_group_exit+0x135/0x370 kernel/exit.c:979
__do_sys_exit_group kernel/exit.c:990 [inline]
__se_sys_exit_group kernel/exit.c:988 [inline]
__x64_sys_exit_group+0x44/0x50 kernel/exit.c:988
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x43f298
Code: Bad RIP value.
RSP: 002b:00007fff6d16b188 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043f298
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004bf068 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d1180 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 8044:
tls_init+0x158/0x7a0 net/tls/tls_main.c:683
tcp_set_ulp+0x216/0x5f0 net/ipv4/tcp_ulp.c:155
do_tcp_setsockopt.isra.0+0x321/0x2320 net/ipv4/tcp.c:2750
tcp_setsockopt+0xbe/0xe0 net/ipv4/tcp.c:3064
sock_common_setsockopt+0x94/0xd0 net/core/sock.c:3044
smc_setsockopt+0xcb/0x790 net/smc/af_smc.c:1652
__sys_setsockopt+0x17a/0x280 net/socket.c:1901
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 8044:
inet_release+0xff/0x1e0 net/ipv4/af_inet.c:428
__sock_release+0x1f4/0x2a0 net/socket.c:579
sock_release+0x18/0x20 net/socket.c:599
smc_release+0x2c1/0x810 net/smc/af_smc.c:156
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x933/0x2fa0 kernel/exit.c:876
do_group_exit+0x135/0x370 kernel/exit.c:979
__do_sys_exit_group kernel/exit.c:990 [inline]
__se_sys_exit_group kernel/exit.c:988 [inline]
__x64_sys_exit_group+0x44/0x50 kernel/exit.c:988
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88809ecae7c0
flags: 0x1fffc0000000100(slab)
raw: 01fffc0000000100 ffffea00026d1a08 ffffea00027c1748 ffff88812c3f0940
raw: 0000000000000000 ffff88809ecae040 0000000100000006 0000000000000000
ffff88809ecae800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff88809ecae880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809ecae900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809ecae980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
HEAD commit: e109a984 Linux 4.19.48
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17be54d4a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=2d14dd88554f26bc
dashboard link: https://syzkaller.appspot.com/bug?extid=3e993c7003fc297efdbe
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1326d186a00000
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=106fd27ca00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3e993c...@syzkaller.appspotmail.com
RBP: 0000000000000004 R08: 0000000000000001 R09: 00007fff6d160033
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401ec0
R13: 0000000000401f50 R14: 0000000000000000 R15: 0000000000000000
==================================================================
BUG: KASAN: use-after-free in tls_write_space+0x2b2/0x310
net/tls/tls_main.c:220
Read of size 1 at addr ffff88809ecae8a0 by task syz-executor758/8044
CPU: 1 PID: 8044 Comm: syz-executor758 Not tainted 4.19.48 #20
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
__asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
tls_write_space+0x2b2/0x310 net/tls/tls_main.c:220
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
__asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
tcp_new_space net/ipv4/tcp_input.c:5141 [inline]
tcp_check_space+0x430/0x720 net/ipv4/tcp_input.c:5152
tcp_data_snd_check net/ipv4/tcp_input.c:5162 [inline]
tcp_rcv_established+0x9e9/0x1f10 net/ipv4/tcp_input.c:5653
tcp_v4_do_rcv+0x616/0x8d0 net/ipv4/tcp_ipv4.c:1535
sk_backlog_rcv include/net/sock.h:941 [inline]
__release_sock+0x129/0x3a0 net/core/sock.c:2337
release_sock+0x59/0x1c0 net/core/sock.c:2853
tls_sk_proto_close+0x691/0xa20 net/tls/tls_main.c:309
inet_release+0xff/0x1e0 net/ipv4/af_inet.c:428
__sock_release+0x1f4/0x2a0 net/socket.c:579
sock_release+0x18/0x20 net/socket.c:599
smc_release+0x2c1/0x810 net/smc/af_smc.c:156
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x933/0x2fa0 kernel/exit.c:876
do_group_exit+0x135/0x370 kernel/exit.c:979
__do_sys_exit_group kernel/exit.c:990 [inline]
__se_sys_exit_group kernel/exit.c:988 [inline]
__x64_sys_exit_group+0x44/0x50 kernel/exit.c:988
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x43f298
Code: Bad RIP value.
RSP: 002b:00007fff6d16b188 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043f298
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004bf068 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d1180 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 8044:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kmem_cache_alloc_trace+0x152/0x760 mm/slab.c:3625
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
create_ctx+0x46/0x1f0 net/tls/tls_main.c:550
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc mm/kasan/kasan.c:553 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kmem_cache_alloc_trace+0x152/0x760 mm/slab.c:3625
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
tls_init+0x158/0x7a0 net/tls/tls_main.c:683
tcp_set_ulp+0x216/0x5f0 net/ipv4/tcp_ulp.c:155
do_tcp_setsockopt.isra.0+0x321/0x2320 net/ipv4/tcp.c:2750
tcp_setsockopt+0xbe/0xe0 net/ipv4/tcp.c:3064
sock_common_setsockopt+0x94/0xd0 net/core/sock.c:3044
smc_setsockopt+0xcb/0x790 net/smc/af_smc.c:1652
__sys_setsockopt+0x17a/0x280 net/socket.c:1901
__do_sys_setsockopt net/socket.c:1912 [inline]
__se_sys_setsockopt net/socket.c:1909 [inline]
__x64_sys_setsockopt+0xbe/0x150 net/socket.c:1909
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
__se_sys_setsockopt net/socket.c:1909 [inline]
__x64_sys_setsockopt+0xbe/0x150 net/socket.c:1909
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 8044:
save_stack+0x45/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
kfree+0xcf/0x220 mm/slab.c:3822
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3503 [inline]
tls_ctx_free.part.0+0x32/0x40 net/tls/tls_main.c:251
tls_ctx_free net/tls/tls_main.c:246 [inline]
tls_sk_proto_close+0x684/0xa20 net/tls/tls_main.c:304
tls_ctx_free net/tls/tls_main.c:246 [inline]
inet_release+0xff/0x1e0 net/ipv4/af_inet.c:428
__sock_release+0x1f4/0x2a0 net/socket.c:579
sock_release+0x18/0x20 net/socket.c:599
smc_release+0x2c1/0x810 net/smc/af_smc.c:156
__sock_release+0xce/0x2a0 net/socket.c:579
sock_close+0x1b/0x30 net/socket.c:1140
__fput+0x2dd/0x8b0 fs/file_table.c:278
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x145/0x1c0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x933/0x2fa0 kernel/exit.c:876
do_group_exit+0x135/0x370 kernel/exit.c:979
__do_sys_exit_group kernel/exit.c:990 [inline]
__se_sys_exit_group kernel/exit.c:988 [inline]
__x64_sys_exit_group+0x44/0x50 kernel/exit.c:988
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88809ecae7c0
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 224 bytes inside of
512-byte region [ffff88809ecae7c0, ffff88809ecae9c0)
The buggy address is located 224 bytes inside of
The buggy address belongs to the page:
page:ffffea00027b2b80 count:1 mapcount:0 mapping:ffff88812c3f0940 index:0x0
flags: 0x1fffc0000000100(slab)
raw: 01fffc0000000100 ffffea00026d1a08 ffffea00027c1748 ffff88812c3f0940
raw: 0000000000000000 ffff88809ecae040 0000000100000006 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809ecae780: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
Memory state around the buggy address:
ffff88809ecae800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff88809ecae880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809ecae900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88809ecae980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
syzbot
Jan 29, 2021, 1:07:11 AM1/29/21
to syzkaller...@googlegroups.com
syzbot suspects this issue was fixed by commit:
commit d71f3fb99620532fee0d163bfb30f0cc7bcdbaee
Author: Anant Thazhemadam <anant.th...@gmail.com>
Date: Mon Oct 5 13:29:58 2020 +0000
net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10868154d00000
start commit: e109a984 Linux 4.19.48
git tree: linux-4.19.y
#syz fix: net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
commit d71f3fb99620532fee0d163bfb30f0cc7bcdbaee
Author: Anant Thazhemadam <anant.th...@gmail.com>
Date: Mon Oct 5 13:29:58 2020 +0000
net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10868154d00000
start commit: e109a984 Linux 4.19.48
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=2d14dd88554f26bc
dashboard link: https://syzkaller.appspot.com/bug?extid=3e993c7003fc297efdbe
dashboard link: https://syzkaller.appspot.com/bug?extid=3e993c7003fc297efdbe
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1326d186a00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=106fd27ca00000
If the result looks correct, please mark the issue as fixed by replying with:
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=106fd27ca00000
#syz fix: net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
Reply all
Reply to author
Forward
0 new messages