Re: net/rds: use-after-free in inet_create

Path	csiph.com!news.redatomik.org!aioe.org!bofh.it!news.nic.it!robomod
From	Sowmini Varadhan <sowmini.varadhan@oracle.com>
Newsgroups	linux.kernel
Subject	Re: net/rds: use-after-free in inet_create
Date	Wed, 01 Mar 2017 01:10:02 +0100
Message-ID	<tg00a-3dN-29@gated-at.bofh.it> (permalink)
References	<tfRpU-5QG-39@gated-at.bofh.it> <tfS2B-6kf-11@gated-at.bofh.it> <tfSlY-6te-23@gated-at.bofh.it> <tfSFj-6Rj-1@gated-at.bofh.it> <tfSYG-70r-9@gated-at.bofh.it> <tfT8m-75J-13@gated-at.bofh.it> <tfTi1-79a-9@gated-at.bofh.it>
MIME-Version	1.0
Content-Type	text/plain; charset=us-ascii
Content-Disposition	inline
User-Agent	Mutt/1.5.24 (2015-08-30)
X-Source-IP	aserp1040.oracle.com [141.146.126.69]
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	38
Organization	linux.* mail to news gateway
X-Original-Cc	santosh.shilimkar@oracle.com, David Miller <davem@davemloft.net>, netdev <netdev@vger.kernel.org>, linux-rdma@vger.kernel.org, rds-devel@oss.oracle.com, LKML <linux-kernel@vger.kernel.org>, Eric Dumazet <edumazet@google.com>, syzkaller <syzkaller@googlegroups.com>
X-Original-Date	Tue, 28 Feb 2017 17:24:10 -0500
X-Original-Message-ID	<20170228222410.GA32635@oracle.com>
X-Original-References	<CACT4Y+bi=rZr9yrajA0o0iUeR4N0q-sXYudBVsOeOiHbuApBeA@mail.gmail.com> <20170228153737.GG31155@oracle.com> <CACT4Y+aobp+g_AYoX6j1eftyyirK4pBxhOXz9hDu+XU+-jxSYw@mail.gmail.com> <20170228161544.GH31155@oracle.com> <CACT4Y+bWWAiMYQN_Fvxs7CKR9hRAA+r0t_YZhja3B5xGcZ4vcQ@mail.gmail.com> <20170228163833.GI31155@oracle.com> <CACT4Y+Y5eM8hKQ7BgA4hEN7ozkhRGgvGJRU6Smrths6noC-PMw@mail.gmail.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1589892

Show key headers only | View raw

Actually, I'm not sure if I can assert that these are all manifestations
of the same bug- was a netns-delete involved in this one as well?

I see:

> BUG: KASAN: use-after-free in memcmp+0xe3/0x160 lib/string.c:768 at
    :
>  memcmp+0xe3/0x160 lib/string.c:768
    :
>  rds_find_bound+0x4fe/0x8a0 net/rds/bind.c:63
>  rds_recv_incoming+0x5f3/0x12c0 net/rds/recv.c:349
>  rds_loop_xmit+0x1c5/0x490 net/rds/loop.c:82
    :
This appears to be for a looped back packet, and looks like there
are problems with  some rds_sock that got removed from the bind_hash_table..

According to the report, socket was created at
> Allocated:
> PID = 5235
    :
>  sk_prot_alloc+0x65/0x2a0 net/core/sock.c:1334
>  sk_alloc+0x105/0x1010 net/core/sock.c:1396
>  rds_create+0x11c/0x600 net/rds/af_rds.c:504

and closed at some point:
> Freed:
> PID = 5235
     :
>  rds_release+0x3a1/0x4d0 net/rds/af_rds.c:89
>  sock_release+0x8d/0x1e0 net/socket.c:599

This is all uspace created rds sockets, and while there may be an
unrelated bug here, I'm not sure I see  the netns/kernel-socket
connection.. can you please clarify if this was also seen in some netns
context?

--Sowmini

Thread

net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 16:00 +0100
  Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 16:40 +0100
    Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 17:00 +0100
      Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 17:20 +0100
        Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 17:40 +0100
          Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 17:50 +0100
            Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 18:00 +0100
              Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 18:40 +0100
                Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-02-28 19:00 +0100
                Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-02-28 20:10 +0100
              Re: net/rds: use-after-free in inet_create Sowmini Varadhan <sowmini.varadhan@oracle.com> - 2017-03-01 01:10 +0100
                Re: net/rds: use-after-free in inet_create Dmitry Vyukov <dvyukov@google.com> - 2017-03-01 11:00 +0100

csiph-web