Re: net/nfc: GPF in llcp_sock_getname

Path	csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	Cong Wang <xiyou.wangcong@gmail.com>
Newsgroups	linux.kernel
Subject	Re: net/nfc: GPF in llcp_sock_getname
Date	Fri, 01 Jan 2016 22:00:02 +0100
Message-ID	<qMeXM-7i5-7@gated-at.bofh.it> (permalink)
References	<qM8pj-39E-3@gated-at.bofh.it>
X-Original-To	Dmitry Vyukov <dvyukov@google.com>
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=e4xxfs5ETwB6wmXYIg2R5Am9Nwut5V4vUIaEVI4tfbU=; b=yF/ajwatAerqgY0DsvsiDb7Q8P6PsT1VyekYJiZo+RhzM1i7HEtxcSTTq6civevUEh UeqH/UvJK3Rr19Je7GPYDe+sF6de9mIar9qt+ORPeZyLLCiimp6qFfCEE9vh/jelaH1A rpaYe7e+RDG6QVgUo3uKQCe1Nxlk3SnFzL1y/l3wYQ2+HFJP3GRfMSDW4dJhSsr5Nr5P eHGgvTqRlR2vcMITlRIC/oULtk/6yl21w/XJury68IZg4D9ILJgi2JLUk4GrgiCJ0tfM z/+7RlFJAsmUhRkx8QmDHG3ftWvuuCfmIAXNs7W5m2EJDL3HJD45GEdoBZvVJRkR8wo/ twHw==
MIME-Version	1.0
X-Received	by 10.129.86.4 with SMTP id k4mr48072011ywb.36.1451681891772; Fri, 01 Jan 2016 12:58:11 -0800 (PST)
Content-Type	text/plain; charset=UTF-8
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	70
Organization	linux.* mail to news gateway
X-Original-Cc	Lauro Ramos Venancio <lauro.venancio@openbossa.org>, Aloisio Almeida Jr <aloisio.almeida@openbossa.org>, Samuel Ortiz <sameo@linux.intel.com>, "David S. Miller" <davem@davemloft.net>, linux-wireless@vger.kernel.org, netdev <netdev@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>, syzkaller <syzkaller@googlegroups.com>, Kostya Serebryany <kcc@google.com>, Alexander Potapenko <glider@google.com>, Sasha Levin <sasha.levin@oracle.com>, Eric Dumazet <edumazet@google.com>
X-Original-Date	Fri, 1 Jan 2016 12:58:11 -0800
X-Original-Message-ID	<CAM_iQpX-vHywG6DJb=5wLCouNAXXqA1wo=tKJ1S78MDyZfkNCw@mail.gmail.com>
X-Original-References	<CACT4Y+baorktL_dBHEWcz_jHYTzhM_-DJoms81bzVx8FbYk63w@mail.gmail.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1299987

Show key headers only | View raw

On Fri, Jan 1, 2016 at 5:58 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
>
> kasan: GPF could be caused by NULL-ptr deref or user memory
> accessgeneral protection fault: 0000 [#51] SMP KASAN
> Modules linked in:
> CPU: 2 PID: 4207 Comm: a.out Not tainted 4.4.0-rc7+ #184
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> task: ffff8800683e9780 ti: ffff880064c70000 task.ti: ffff880064c70000
> RIP: 0010:[<ffffffff816d1d5b>]  [<ffffffff816d1d5b>]
> kasan_report_error+0x1b/0x560
> RSP: 0018:ffff880064c77c90  EFLAGS: 00010286
> RAX: dffffc0000000000 RBX: 0000000000000003 RCX: dffffc0000000000
> RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff880064c77c98
> RBP: ffff880064c77cc0 R08: ffffed000c98efd6 R09: ffff880064c77e58
> R10: ffff8800639670a0 R11: ffff880063967098 R12: ffff880064c77e6a
> R13: 0000000000000000 R14: 0000000000000000 R15: ffff880063967088
> FS:  00000000018ca880(0063) GS:ffff88006da00000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> CR2: 000000c8200012e0 CR3: 0000000064c59000 CR4: 00000000000006e0
> Stack:
>  ffffffff816d25d4 0000000000000000 0000000000000018 0000000000000003
>  0000000300004000 ffffffff816d17ed ffff880064c77cd0 ffffffff816d1264
>  ffff880064c77cf8 ffffffff816d17ed 0000000000000000 ffff880064c77e58
> Call Trace:
>  [<     inline     >] check_memory_region mm/kasan/kasan.c:264
>  [<ffffffff816d1264>] __asan_loadN+0x124/0x1a0 mm/kasan/kasan.c:512
>  [<ffffffff816d17ed>] memcpy+0x1d/0x40 mm/kasan/kasan.c:297
>  [<ffffffff85becf44>] llcp_sock_getname+0x424/0x600 net/nfc/llcp_sock.c:519
>  [<ffffffff84b5ab4d>] SYSC_getsockname+0x1bd/0x220 net/socket.c:1570
>  [<ffffffff84b60244>] SyS_getsockname+0x24/0x30 net/socket.c:1555
>  [<ffffffff85c8eaf6>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
> Code: 48 01 c7 e8 38 2b fc ff 5d c3 66 0f 1f 44 00 00 48 8b 17 48 b9
> 00 00 00 00 00 fc ff df 48 8b 77 10 48 89 d0 48 c1 e8 03 48 01 c8 <80>
> 38 00 75 1d 48 01 d6 eb 13 48 83 c2 08 48 89 d0 48 c1 e8 03
> RIP  [<ffffffff816d1d5b>] kasan_report_error+0x1b/0x560 mm/kasan/report.c:214
>  RSP <ffff880064c77c90>
> ---[ end trace b0c68fb0d02b9447 ]---
>
> On commit 8513342170278468bac126640a5d2d12ffbff106 (Dec 28).
> GPF seems to be caused by a data race on socket state.

It looks like we forget to initialize ->service_name_len
and ->servicce_name before bind().

Could you try the following patch?

Thanks!

----------------->

diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index ecf0a01..252f3c0 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -961,6 +961,8 @@ struct sock *nfc_llcp_sock_alloc(struct socket
*sock, int type, gfp_t gfp, int k

        llcp_sock->ssap = 0;
        llcp_sock->dsap = LLCP_SAP_SDP;
+       llcp_sock->service_name_len = 0;
+       llcp_sock->service_name = NULL;
        llcp_sock->rw = LLCP_MAX_RW + 1;
        llcp_sock->miux = cpu_to_be16(LLCP_MAX_MIUX + 1);
        llcp_sock->send_n = llcp_sock->send_ack_n = 0;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

net/nfc: GPF in llcp_sock_getname Dmitry Vyukov <dvyukov@google.com> - 2016-01-01 15:00 +0100
  Re: net/nfc: GPF in llcp_sock_getname Cong Wang <xiyou.wangcong@gmail.com> - 2016-01-01 22:00 +0100
    Re: net/nfc: GPF in llcp_sock_getname Cong Wang <xiyou.wangcong@gmail.com> - 2016-01-02 00:30 +0100
  Re: net/nfc: GPF in llcp_sock_getname Cong Wang <xiyou.wangcong@gmail.com> - 2016-01-02 01:00 +0100

csiph-web