Messages in this thread | | | From | Andrey Konovalov <> | Date | Tue, 18 Apr 2017 22:43:35 +0200 | Subject | Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone |
| |
Hi!
I've finally managed to reproduce one of the crashes on commit 4f7d029b9bf009fbee76bb10c0c4351a1870d2f3 (4.11-rc7).
I'm not sure if this bug has the same root cause as the first one reported in this thread, but it definitely has to do with ipv6 routing.
C reproducer, syzkaller program and my .config are attached.
Thanks!
kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN Modules linked in: CPU: 1 PID: 4035 Comm: a.out Not tainted 4.11.0-rc7+ #250 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880069809600 task.stack: ffff880062dc8000 RIP: 0010:ip6_rt_cache_alloc+0xa6/0x560 net/ipv6/route.c:975 RSP: 0018:ffff880062dced30 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff8800670561c0 RCX: 0000000000000006 RDX: 0000000000000003 RSI: ffff880062dcfb28 RDI: 0000000000000018 RBP: ffff880062dced68 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff880062dcfb28 R14: dffffc0000000000 R15: 0000000000000000 FS: 00007feebe37e7c0(0000) GS:ffff88006cb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000205a0fe4 CR3: 000000006b5c9000 CR4: 00000000000006e0 Call Trace: ip6_pol_route+0x1512/0x1f20 net/ipv6/route.c:1128 ip6_pol_route_output+0x4c/0x60 net/ipv6/route.c:1212 fib6_rule_action+0x261/0x8a0 net/ipv6/fib6_rules.c:100 fib_rules_lookup+0x3be/0xbc0 net/core/fib_rules.c:265 fib6_rule_lookup+0x175/0x360 net/ipv6/fib6_rules.c:44 ip6_route_output_flags+0x260/0x2f0 net/ipv6/route.c:1240 ip6_route_output ./include/net/ip6_route.h:79 ip6_dst_lookup_tail+0xd5e/0x18b0 net/ipv6/ip6_output.c:959 ip6_dst_lookup_flow+0xb1/0x260 net/ipv6/ip6_output.c:1082 rawv6_sendmsg+0x11b2/0x42e0 net/ipv6/raw.c:903 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg+0xca/0x110 net/socket.c:643 SYSC_sendto+0x660/0x810 net/socket.c:1696 SyS_sendto+0x40/0x50 net/socket.c:1664 entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:204 RIP: 0033:0x7feebda90b79 RSP: 002b:000000000072fee8 EFLAGS: 00000206 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007ffe1f920180 RCX: 00007feebda90b79 RDX: 0000000000000000 RSI: 0000000020fd0fd0 RDI: 0000000000000004 RBP: 0000000000400f30 R08: 00000000205a0fe4 R09: 000000000000001c R10: 0000000000000800 R11: 0000000000000206 R12: 0000000000000000 R13: 00007ffe1f920180 R14: 0000000000000000 R15: 0000000000000000 Code: 03 80 3c 02 00 0f 85 37 04 00 00 4d 8b 64 24 40 e8 90 dd 82 fd 49 8d 7c 24 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 61 04 00 00 49 8b 74 24 18 48 b8 00 00 00 00 RIP: ip6_rt_cache_alloc+0xa6/0x560 RSP: ffff880062dced30 ---[ end trace 9f58077ffa8cf9c0 ]--- [unhandled content-type:application/octet-stream]// autogenerated by syzkaller (http://github.com/google/syzkaller)
#ifndef __NR_mmap #define __NR_mmap 9 #endif #ifndef __NR_socket #define __NR_socket 41 #endif #ifndef __NR_ioctl #define __NR_ioctl 16 #endif #ifndef __NR_sendto #define __NR_sendto 44 #endif
#define _GNU_SOURCE
#include <sys/ioctl.h> #include <sys/mman.h> #include <sys/mount.h> #include <sys/prctl.h> #include <sys/resource.h> #include <sys/socket.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/time.h> #include <sys/types.h> #include <sys/wait.h>
#include <linux/capability.h> #include <linux/if.h> #include <linux/if_tun.h> #include <linux/kvm.h> #include <linux/sched.h> #include <net/if_arp.h>
#include <assert.h> #include <dirent.h> #include <errno.h> #include <fcntl.h> #include <grp.h> #include <pthread.h> #include <setjmp.h> #include <signal.h> #include <stdarg.h> #include <stdbool.h> #include <stddef.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h>
const int kFailStatus = 67; const int kErrorStatus = 68; const int kRetryStatus = 69;
__attribute__((noreturn)) void doexit(int status) { volatile unsigned i; syscall(__NR_exit_group, status); for (i = 0;; i++) { } }
__attribute__((noreturn)) void fail(const char* msg, ...) { int e = errno; fflush(stdout); va_list args; va_start(args, msg); vfprintf(stderr, msg, args); va_end(args); fprintf(stderr, " (errno %d)\n", e); doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus); }
__attribute__((noreturn)) void exitf(const char* msg, ...) { int e = errno; fflush(stdout); va_list args; va_start(args, msg); vfprintf(stderr, msg, args); va_end(args); fprintf(stderr, " (errno %d)\n", e); doexit(kRetryStatus); }
static int flag_debug;
void debug(const char* msg, ...) { if (!flag_debug) return; va_list args; va_start(args, msg); vfprintf(stdout, msg, args); va_end(args); fflush(stdout); }
__thread int skip_segv; __thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* uctx) { uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) { debug("SIGSEGV on %p, skipping\n", addr); _longjmp(segv_env, 1); } debug("SIGSEGV on %p, exiting\n", addr); doexit(sig); for (;;) { } }
static void install_segv_handler() { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); }
#define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ }
#define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1)
#define BITMASK_LEN_OFF(type, bf_off, bf_len) \ (type)(BITMASK_LEN(type, (bf_len)) << (bf_off))
#define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \ if ((bf_off) == 0 && (bf_len) == 0) { \ *(type*)(addr) = (type)(val); \ } else { \ type new_val = *(type*)(addr); \ new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \ new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \ *(type*)(addr) = new_val; \ }
static uintptr_t execute_syscall(int nr, uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7, uintptr_t a8) { switch (nr) { default: return syscall(nr, a0, a1, a2, a3, a4, a5); } }
static void setup_main_process() { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_IGN; syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); install_segv_handler();
char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) fail("failed to mkdtemp"); if (chmod(tmpdir, 0777)) fail("failed to chmod"); if (chdir(tmpdir)) fail("failed to chdir"); }
static void loop();
static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); setsid();
struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 128 << 20; setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim);
unshare(CLONE_NEWNS); unshare(CLONE_NEWIPC); unshare(CLONE_IO); }
static int real_uid; static int real_gid; static int epid; static bool etun; __attribute__((aligned(64 << 10))) static char sandbox_stack[1 << 20];
static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { close(fd); return false; } close(fd); return true; }
static int namespace_sandbox_proc(void* arg) { sandbox_common();
write_file("/proc/self/setgroups", "deny"); if (!write_file("/proc/self/uid_map", "0 %d 1\n", real_uid)) fail("write of /proc/self/uid_map failed"); if (!write_file("/proc/self/gid_map", "0 %d 1\n", real_gid)) fail("write of /proc/self/gid_map failed");
if (mkdir("./syz-tmp", 0777)) fail("mkdir(syz-tmp) failed"); if (mount("", "./syz-tmp", "tmpfs", 0, NULL)) fail("mount(tmpfs) failed"); if (mkdir("./syz-tmp/newroot", 0777)) fail("mkdir failed"); if (mkdir("./syz-tmp/newroot/dev", 0700)) fail("mkdir failed"); if (mount("/dev", "./syz-tmp/newroot/dev", NULL, MS_BIND | MS_REC | MS_PRIVATE, NULL)) fail("mount(dev) failed"); if (mkdir("./syz-tmp/pivot", 0777)) fail("mkdir failed"); if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) { debug("pivot_root failed"); if (chdir("./syz-tmp")) fail("chdir failed"); } else { if (chdir("/")) fail("chdir failed"); if (umount2("./pivot", MNT_DETACH)) fail("umount failed"); } if (chroot("./newroot")) fail("chroot failed"); if (chdir("/")) fail("chdir failed");
struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) fail("capget failed"); cap_data[0].effective &= ~(1 << CAP_SYS_PTRACE); cap_data[0].permitted &= ~(1 << CAP_SYS_PTRACE); cap_data[0].inheritable &= ~(1 << CAP_SYS_PTRACE); if (syscall(SYS_capset, &cap_hdr, &cap_data)) fail("capset failed");
loop(); doexit(1); }
static int do_sandbox_namespace(int executor_pid, bool enable_tun) { real_uid = getuid(); real_gid = getgid(); epid = executor_pid; etun = enable_tun; mprotect(sandbox_stack, 4096, PROT_NONE); return clone( namespace_sandbox_proc, &sandbox_stack[sizeof(sandbox_stack) - 64], CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWUTS | CLONE_NEWNET, NULL); }
long r[67]; void loop() { memset(r, -1, sizeof(r)); r[0] = execute_syscall(__NR_mmap, 0x2057b000ul, 0x2000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul, 0, 0, 0); r[1] = execute_syscall(__NR_socket, 0xaul, 0x1ul, 0x84ul, 0, 0, 0, 0, 0, 0); NONFAILING(*(uint8_t*)0x2057cfb0 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfb1 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfb2 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfb3 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfb4 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfb5 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfb6 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfb7 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfb8 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfb9 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfba = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfbb = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfbc = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfbd = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfbe = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfbf = (uint8_t)0x0); NONFAILING(*(uint64_t*)0x2057cfc0 = (uint64_t)0x0); NONFAILING(*(uint64_t*)0x2057cfc8 = (uint64_t)0x100000000000000); NONFAILING(*(uint8_t*)0x2057cfd0 = (uint8_t)0xfd); NONFAILING(*(uint8_t*)0x2057cfd1 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfd2 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfd3 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfd4 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfd5 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfd6 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfd7 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfd8 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfd9 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfda = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfdb = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfdc = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfdd = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfde = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2057cfdf = (uint8_t)0xaa); NONFAILING(*(uint32_t*)0x2057cfe0 = (uint32_t)0x4); NONFAILING(*(uint16_t*)0x2057cfe4 = (uint16_t)0x4000000000); NONFAILING(*(uint16_t*)0x2057cfe6 = (uint16_t)0x7); NONFAILING(*(uint32_t*)0x2057cfe8 = (uint32_t)0x100); NONFAILING(*(uint64_t*)0x2057cff0 = (uint64_t)0x80000001); NONFAILING(*(uint32_t*)0x2057cff8 = (uint32_t)0x40000000); NONFAILING(*(uint32_t*)0x2057cffc = (uint32_t)0x9); r[43] = execute_syscall(__NR_ioctl, r[1], 0x890bul, 0x2057cfb0ul, 0, 0, 0, 0, 0, 0); r[44] = execute_syscall(__NR_mmap, 0x20000000ul, 0xfd0000ul, 0x1ul, 0x32ul, 0xfffffffffffffffful, 0x0ul, 0, 0, 0); r[45] = execute_syscall(__NR_socket, 0xaul, 0x803ul, 0xfful, 0, 0, 0, 0, 0, 0); NONFAILING(*(uint16_t*)0x205a0fe4 = (uint16_t)0xa); NONFAILING(*(uint16_t*)0x205a0fe6 = (uint16_t)0x234e); NONFAILING(*(uint32_t*)0x205a0fe8 = (uint32_t)0x6); NONFAILING(*(uint8_t*)0x205a0fec = (uint8_t)0xfd); NONFAILING(*(uint8_t*)0x205a0fed = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0fee = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0fef = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ff0 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ff1 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ff2 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ff3 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ff4 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ff5 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ff6 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ff7 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ff8 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ff9 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ffa = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x205a0ffb = (uint8_t)0xbb); NONFAILING(*(uint32_t*)0x205a0ffc = (uint32_t)0x1); r[66] = execute_syscall(__NR_sendto, r[45], 0x20fd0fd0ul, 0x0ul, 0x800ul, 0x205a0fe4ul, 0x1cul, 0, 0, 0); } int main() { setup_main_process(); int pid = do_sandbox_namespace(0, false); int status = 0; while (waitpid(pid, &status, __WALL) != pid) { } return 0; } [unhandled content-type:application/octet-stream] | |