Re: net/can: use-after-free in bcm_rx_thr_flush

Path	csiph.com!news.mixmin.net!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod
From	Oliver Hartkopp <socketcan@hartkopp.net>
Newsgroups	linux.kernel
Subject	Re: net/can: use-after-free in bcm_rx_thr_flush
Date	Tue, 22 Nov 2016 18:40:03 +0100
Message-ID	<sGnd0-1Py-39@gated-at.bofh.it> (permalink)
References	<sGfyO-5hl-15@gated-at.bofh.it>
X-Original-To	Andrey Konovalov <andreyknvl@google.com>, Marc Kleine-Budde <mkl@pengutronix.de>, "David S. Miller" <davem@davemloft.net>, linux-can@vger.kernel.org, netdev <netdev@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; t=1479835775; l=2260; s=domk; d=hartkopp.net; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:MIME-Version: Date:From:Cc:References:To:Subject; bh=NQBC7NFqXpkLA/GayMqZ1C9o8E70n7vDi/QAACulbhc=; b=MWp/Bu6nRxO54yYTl7rUu0uyvNnkgmbiBQWOSD4FlHpNeeAr3lDhFKjnIiN/oMLBws M8T5r+Cs2fJNkfoJgPe6v0X/4becU4v7RHWiDmQ3QRz+Kqr/iHOFvjJ3NlxJBZ88jDpo YzXyYr0pTScQ072Qu1yQ3FT1Kzl/FVwwG3FjU=
X-Rzg-Auth	:P2MHfkW8eP4Mre39l357AZT/I7AY/7nT2yrT1q0ngWNsKR9DbcDvsfbZ70J0gsYNqts6
X-Rzg-Class-ID	mo00
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.4.0
MIME-Version	1.0
Content-Type	text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding	7bit
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	75
Organization	linux.* mail to news gateway
X-Original-Cc	Dmitry Vyukov <dvyukov@google.com>, Alexander Potapenko <glider@google.com>, Kostya Serebryany <kcc@google.com>, Eric Dumazet <edumazet@google.com>, syzkaller <syzkaller@googlegroups.com>
X-Original-Date	Tue, 22 Nov 2016 18:29:30 +0100
X-Original-Message-ID	<5abd6ebd-1249-71a9-da30-65d8371a2a36@hartkopp.net>
X-Original-References	<CAAeHK+xhwpVO=xHqEOyP-Tm6cx1+jDLDpYT0hpMwM2PCf7W3Jw@mail.gmail.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1527763

Show key headers only | View raw

Hi Andrey,

thanks for the report.

Although I can't see the issue in the code ...

On 11/22/2016 10:22 AM, Andrey Konovalov wrote:

> ==================================================================
> BUG: KASAN: use-after-free in bcm_rx_thr_flush+0x284/0x2b0
> Read of size 1 at addr ffff88006c1faae5 by task a.out/3874
>
> page:ffffea0001b07e80 count:1 mapcount:0 mapping:          (null) index:0x0
> flags: 0x100000000000080(slab)
> page dumped because: kasan: bad access detected

(..)

>
> The buggy address belongs to the object at ffff88006c1faae0
>  which belongs to the cache kmalloc-32 of size 32

???

> The buggy address ffff88006c1faae5 is located 5 bytes inside
>  of 32-byte region [ffff88006c1faae0, ffff88006c1fab00)

(..)

> Memory state around the buggy address:
>  ffff88006c1fa980: fc fc fb fb fb fb fc fc fb fb fb fb fc fc fb fb
>  ffff88006c1faa00: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc
>> ffff88006c1faa80: fb fb fb fb fc fc fb fb fb fb fc fc fb fb fb fb
>                                                        ^
>  ffff88006c1fab00: fc fc fb fb fb fb fc fc 00 00 00 00 fc fc 00 00
>  ffff88006c1fab80: 00 00 fc fc fb fb fb fb fc fc fb fb fb fb fc fc
> ==================================================================

(should be some zero initialized memory here)

The relevant code of bcm_rx_do_flush() can be found here:

http://lxr.free-electrons.com/source/net/can/bcm.c#L589

static inline int bcm_rx_do_flush(struct bcm_op *op, int update,
				  unsigned int index)
{
	struct canfd_frame *lcf = op->last_frames + op->cfsiz * index;

	if ((op->last_frames) && (lcf->flags & RX_THR)) {  <<<----- !!!
		if (update)
			bcm_rx_changed(op, lcf);
		return 1;
	}
	return 0;
}


lcf->flags points into an array of struct canfd_frame at offset 5 which 
is allocated here:

http://lxr.free-electrons.com/source/net/can/bcm.c#L1105

	/* create and init array for received CAN frames */
	op->last_frames = kzalloc(msg_head->nframes * op->cfsiz,
				  GFP_KERNEL);

So why does KASAN complain about accessing some kind of 32 byte cache 
when it should point into a zero initialized allocated space?

I will write some other test cases with a similar setting of options to 
check if I can trigger the instability too.

Tnx & regards,
Oliver

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

net/can: use-after-free in bcm_rx_thr_flush Andrey Konovalov <andreyknvl@google.com> - 2016-11-22 10:30 +0100
  Re: net/can: use-after-free in bcm_rx_thr_flush Andrey Konovalov <andreyknvl@google.com> - 2016-11-22 18:40 +0100
    Re: net/can: use-after-free in bcm_rx_thr_flush Oliver Hartkopp <socketcan@hartkopp.net> - 2016-11-23 07:10 +0100
  Re: net/can: use-after-free in bcm_rx_thr_flush Oliver Hartkopp <socketcan@hartkopp.net> - 2016-11-22 18:40 +0100

csiph-web