lkml.org 
[lkml]   [2019]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: KASAN: use-after-free Read in seccomp_notify_release (2)
On Tue, Apr 23, 2019 at 02:39:52PM -0700, Kees Cook wrote:
> On Mon, Mar 25, 2019 at 1:02 AM syzbot
> <syzbot+b562969adb2e04af3442@syzkaller.appspotmail.com> wrote:
> >
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit: 1bdd3dbf Merge tag 'io_uring-20190323' of git://git.kernel..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=12ae5b93200000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=9a31fb246de2a622
> > dashboard link: https://syzkaller.appspot.com/bug?extid=b562969adb2e04af3442
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=162ca25d200000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1733b53b200000
> >
> > The bug was bisected to:
> >
> > commit a799aea0988ea0d1b1f263e996fdad2f6133c680
> > Author: wenxu <wenxu@ucloud.cn>
> > Date: Wed Jan 9 02:40:11 2019 +0000
> >
> > netfilter: nft_flow_offload: Fix reverse route lookup
>
> This bisection looks bogus?
>
> However, I _can_ trigger the problem on this kernel version with this
> config. (And not with Linus's latest tree.)
>
> The PoC is identical to the prior report[1] that we thought was fixed.
> Perhaps the fix didn't actually fix it? (I mean
> a811dc61559e0c8003f1086c2a4dc8e4d5ae4cb8) But it's been silent for 29
> days now, so I'm not sure what's going on.
>
> Tycho are you able to reproduce this on the older tree?

It looks like this case is using TSYNC and NEW_LISTENER together:

syscall(__NR_seccomp, 1, 0xb, 0x20000140);

and I did fix a uaf with TSYNC and NEW_LISTENER in this series:

https://lore.kernel.org/lkml/20190306201413.14153-2-tycho@tycho.ws/T/#u

which seems like it's probably related. I don't think the above ever
got applied though?

Tycho

\
 
 \ /
  Last update: 2019-04-23 23:53    [W:0.056 / U:2.188 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site