Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1244593 > unrolled thread

Use-after-free in ep_remove_wait_queue

Started byDmitry Vyukov <dvyukov@google.com>
First post2015-10-12 13:10 +0200
Last post2015-10-12 14:20 +0200
Articles 4 — 3 participants

Back to article view | Back to linux.kernel

Contents

  Use-after-free in ep_remove_wait_queue Dmitry Vyukov <dvyukov@google.com> - 2015-10-12 13:10 +0200
    Re: Use-after-free in ep_remove_wait_queue Michal Kubecek <mkubecek@suse.cz> - 2015-10-12 14:10 +0200
      Re: Use-after-free in ep_remove_wait_queue Dmitry Vyukov <dvyukov@google.com> - 2015-10-12 14:20 +0200
      Re: Use-after-free in ep_remove_wait_queue Eric Dumazet <eric.dumazet@gmail.com> - 2015-10-12 14:20 +0200

#1244593 — Use-after-free in ep_remove_wait_queue

FromDmitry Vyukov <dvyukov@google.com>
Date2015-10-12 13:10 +0200
SubjectUse-after-free in ep_remove_wait_queue
Message-ID<qiJ9o-5w0-9@gated-at.bofh.it>
Hello,

The following program causes use-after-in kernel:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <syscall.h>
#include <string.h>
#include <stdint.h>

int main()
{
        long r0 = syscall(SYS_mmap, 0x20001000ul, 0x1000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul);
        long r1 = syscall(SYS_mmap, 0x20000000ul, 0x1000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul);
        long r2 = syscall(SYS_socketpair, 0x1ul, 0x3ul, 0x1ul, 0x20000ffcul);
        long r3 = -1;
        if (r2 != -1)
                r3 = *(uint32_t*)0x20000ffc;
        long r4 = -1;
        if (r2 != -1)
                r4 = *(uint32_t*)0x20001000;
        long r5 = syscall(SYS_epoll_create, 0x1ul);
        long r6 = syscall(SYS_mmap, 0x20003000ul, 0x1000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul);
        long r7 = syscall(SYS_dup3, r4, r3, 0x80000ul);
        *(uint32_t*)0x20003000 = 0x6;
        *(uint32_t*)0x20003004 = 0x2;
        *(uint64_t*)0x20003008 = 0x6;
        long r11 = syscall(SYS_epoll_ctl, r5, 0x1ul, r3, 0x20003000ul);
        long r12 = syscall(SYS_mmap, 0x20002000ul, 0x1000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul);
        memcpy((void*)0x20002000, "\x00", 1);
        long r14 = syscall(SYS_write, r7, 0x20002000ul, 0x1ul);
        *(uint64_t*)0x20001a4d = 0x5;
        long r16 = syscall(SYS_epoll_pwait, r5, 0x20004000ul, 0x1ul,
0x1ul, 0x20001a4dul, 0x8ul);
        return 0;
}


on commit bcee19f424a0d8c26ecf2607b73c690802658b29
(git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git)

BUG: KASan: use after free in remove_wait_queue+0xfb/0x120 at addr
ffff88002db3cf50
Write of size 8 by task syzkaller_execu/10568
================================================================
BUG UNIX (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------

Call Trace:
 [<     inline     >] __list_del include/linux/list.h:89
 [<     inline     >] list_del include/linux/list.h:107
 [<     inline     >] __remove_wait_queue include/linux/wait.h:145
 [<ffffffff811bfbab>] remove_wait_queue+0xfb/0x120 kernel/sched/wait.c:50
 [<     inline     >] ep_remove_wait_queue fs/eventpoll.c:524
 [<ffffffff8154094b>] ep_unregister_pollwait.isra.7+0x10b/0x1c0
fs/eventpoll.c:542
 [<ffffffff81541417>] ep_free+0x97/0x190 fs/eventpoll.c:759 (discriminator 3)
 [<ffffffff81541554>] ep_eventpoll_release+0x44/0x60 fs/eventpoll.c:791
 [<ffffffff814772ad>] __fput+0x21d/0x6e0 fs/file_table.c:208
 [<ffffffff814777f5>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff81150094>] task_work_run+0x164/0x1f0 kernel/task_work.c:115
(discriminator 1)
 [<     inline     >] exit_task_work include/linux/task_work.h:21
 [<ffffffff810fe7ae>] do_exit+0xa4e/0x2d40 kernel/exit.c:746
 [<ffffffff81104426>] do_group_exit+0xf6/0x340 kernel/exit.c:874
 [<     inline     >] SYSC_exit_group kernel/exit.c:885
 [<ffffffff8110468d>] SyS_exit_group+0x1d/0x20 kernel/exit.c:883
 [<ffffffff82e424d1>] entry_SYSCALL_64_fastpath+0x31/0x95
arch/x86/entry/entry_64.S:187

INFO: Allocated in sk_prot_alloc+0x69/0x340 age=6 cpu=1 pid=10568
[<      none      >] __slab_alloc+0x426/0x470 mm/slub.c:2402
[<     inline     >] slab_alloc_node mm/slub.c:2470
[<     inline     >] slab_alloc mm/slub.c:2512
[<      none      >] kmem_cache_alloc+0x10d/0x140 mm/slub.c:2517
[<      none      >] sk_prot_alloc+0x69/0x340 net/core/sock.c:1329
[<      none      >] sk_alloc+0x33/0x280 net/core/sock.c:1404
[<      none      >] unix_create1+0x5e/0x3d0 net/unix/af_unix.c:648
[<      none      >] unix_create+0x14d/0x1f0 net/unix/af_unix.c:707
[<      none      >] __sock_create+0x1f1/0x4c0 net/socket.c:1169
[<     inline     >] sock_create net/socket.c:1209
[<     inline     >] SYSC_socketpair net/socket.c:1281
[<      none      >] SyS_socketpair+0x10f/0x4d0 net/socket.c:1260
[<      none      >] entry_SYSCALL_64_fastpath+0x31/0x95
arch/x86/entry/entry_64.S:187

INFO: Freed in sk_destruct+0x2e9/0x400 age=9 cpu=1 pid=10568
[<      none      >] __slab_free+0x12d/0x280 mm/slub.c:2587 (discriminator 1)
[<     inline     >] slab_free mm/slub.c:2736
[<      none      >] kmem_cache_free+0x161/0x180 mm/slub.c:2745
[<     inline     >] sk_prot_free net/core/sock.c:1374
[<      none      >] sk_destruct+0x2e9/0x400 net/core/sock.c:1452
[<      none      >] __sk_free+0x57/0x200 net/core/sock.c:1460
[<      none      >] sk_free+0x30/0x40 net/core/sock.c:1471
[<     inline     >] sock_put include/net/sock.h:1593
[<      none      >] unix_dgram_sendmsg+0xeaf/0x1100 net/unix/af_unix.c:1571
[<     inline     >] sock_sendmsg_nosec net/socket.c:610
[<      none      >] sock_sendmsg+0xca/0x110 net/socket.c:620
[<      none      >] sock_write_iter+0x216/0x3a0 net/socket.c:819
[<     inline     >] new_sync_write fs/read_write.c:478
[<      none      >] __vfs_write+0x2ed/0x3d0 fs/read_write.c:491
[<      none      >] vfs_write+0x173/0x4a0 fs/read_write.c:538
[<     inline     >] SYSC_write fs/read_write.c:585
[<      none      >] SyS_write+0x108/0x220 fs/read_write.c:577
[<      none      >] entry_SYSCALL_64_fastpath+0x31/0x95
arch/x86/entry/entry_64.S:187

INFO: Slab 0xffffea0000b6ce00 objects=26 used=4 fp=0xffff88002db3cc00
flags=0x100000000004080
INFO: Object 0xffff88002db3cc00 @offset=19456 fp=0xffff88002db3c280
CPU: 1 PID: 10568 Comm: syzkaller_execu Tainted: G    B           4.3.0-rc2+ #12
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 00000000ffffffff ffff880026647a80 ffffffff81a425a0 ffff88002e17c000
 ffff88002db3cc00 ffff88002db38000 ffff880026647ab0 ffffffff8145a554
 ffff88002e17c000 ffffea0000b6ce00 ffff88002db3cc00 ffff88002db3cf40

Memory state around the buggy address:
 ffff88002db3ce00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88002db3ce80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88002db3cf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff88002db3cf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88002db3d000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
=========================================================

Found with syzkaller fuzzer.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1244629

FromMichal Kubecek <mkubecek@suse.cz>
Date2015-10-12 14:10 +0200
Message-ID<qiK5s-6T6-11@gated-at.bofh.it>
In reply to#1244593
On Mon, Oct 12, 2015 at 01:07:55PM +0200, Dmitry Vyukov wrote:
> Hello,
> 
> The following program causes use-after-in kernel:
> 
...
>         long r0 = syscall(SYS_mmap, 0x20001000ul, 0x1000ul, 0x3ul,
> 0x32ul, 0xfffffffffffffffful, 0x0ul);
>         long r1 = syscall(SYS_mmap, 0x20000000ul, 0x1000ul, 0x3ul,
> 0x32ul, 0xfffffffffffffffful, 0x0ul);
>         long r2 = syscall(SYS_socketpair, 0x1ul, 0x3ul, 0x1ul, 0x20000ffcul);
>         long r3 = -1;
>         if (r2 != -1)
>                 r3 = *(uint32_t*)0x20000ffc;
>         long r4 = -1;
>         if (r2 != -1)
>                 r4 = *(uint32_t*)0x20001000;
>         long r5 = syscall(SYS_epoll_create, 0x1ul);
>         long r6 = syscall(SYS_mmap, 0x20003000ul, 0x1000ul, 0x3ul,
> 0x32ul, 0xfffffffffffffffful, 0x0ul);
>         long r7 = syscall(SYS_dup3, r4, r3, 0x80000ul);
>         *(uint32_t*)0x20003000 = 0x6;
>         *(uint32_t*)0x20003004 = 0x2;
>         *(uint64_t*)0x20003008 = 0x6;
>         long r11 = syscall(SYS_epoll_ctl, r5, 0x1ul, r3, 0x20003000ul);
>         long r12 = syscall(SYS_mmap, 0x20002000ul, 0x1000ul, 0x3ul,
> 0x32ul, 0xfffffffffffffffful, 0x0ul);
>         memcpy((void*)0x20002000, "\x00", 1);
>         long r14 = syscall(SYS_write, r7, 0x20002000ul, 0x1ul);
>         *(uint64_t*)0x20001a4d = 0x5;
>         long r16 = syscall(SYS_epoll_pwait, r5, 0x20004000ul, 0x1ul,
> 0x1ul, 0x20001a4dul, 0x8ul);
>         return 0;
...
> Call Trace:
>  [<     inline     >] __list_del include/linux/list.h:89
>  [<     inline     >] list_del include/linux/list.h:107
>  [<     inline     >] __remove_wait_queue include/linux/wait.h:145
>  [<ffffffff811bfbab>] remove_wait_queue+0xfb/0x120 kernel/sched/wait.c:50
>  [<     inline     >] ep_remove_wait_queue fs/eventpoll.c:524
>  [<ffffffff8154094b>] ep_unregister_pollwait.isra.7+0x10b/0x1c0
> fs/eventpoll.c:542
>  [<ffffffff81541417>] ep_free+0x97/0x190 fs/eventpoll.c:759 (discriminator 3)
>  [<ffffffff81541554>] ep_eventpoll_release+0x44/0x60 fs/eventpoll.c:791
>  [<ffffffff814772ad>] __fput+0x21d/0x6e0 fs/file_table.c:208
>  [<ffffffff814777f5>] ____fput+0x15/0x20 fs/file_table.c:244
>  [<ffffffff81150094>] task_work_run+0x164/0x1f0 kernel/task_work.c:115
> (discriminator 1)
>  [<     inline     >] exit_task_work include/linux/task_work.h:21
>  [<ffffffff810fe7ae>] do_exit+0xa4e/0x2d40 kernel/exit.c:746
>  [<ffffffff81104426>] do_group_exit+0xf6/0x340 kernel/exit.c:874
>  [<     inline     >] SYSC_exit_group kernel/exit.c:885
>  [<ffffffff8110468d>] SyS_exit_group+0x1d/0x20 kernel/exit.c:883
>  [<ffffffff82e424d1>] entry_SYSCALL_64_fastpath+0x31/0x95
> arch/x86/entry/entry_64.S:187
> 
> INFO: Allocated in sk_prot_alloc+0x69/0x340 age=6 cpu=1 pid=10568
> [<      none      >] __slab_alloc+0x426/0x470 mm/slub.c:2402
> [<     inline     >] slab_alloc_node mm/slub.c:2470
> [<     inline     >] slab_alloc mm/slub.c:2512
> [<      none      >] kmem_cache_alloc+0x10d/0x140 mm/slub.c:2517
> [<      none      >] sk_prot_alloc+0x69/0x340 net/core/sock.c:1329
> [<      none      >] sk_alloc+0x33/0x280 net/core/sock.c:1404
> [<      none      >] unix_create1+0x5e/0x3d0 net/unix/af_unix.c:648
> [<      none      >] unix_create+0x14d/0x1f0 net/unix/af_unix.c:707
> [<      none      >] __sock_create+0x1f1/0x4c0 net/socket.c:1169
> [<     inline     >] sock_create net/socket.c:1209
> [<     inline     >] SYSC_socketpair net/socket.c:1281
> [<      none      >] SyS_socketpair+0x10f/0x4d0 net/socket.c:1260
> [<      none      >] entry_SYSCALL_64_fastpath+0x31/0x95
> arch/x86/entry/entry_64.S:187
> 
> INFO: Freed in sk_destruct+0x2e9/0x400 age=9 cpu=1 pid=10568
> [<      none      >] __slab_free+0x12d/0x280 mm/slub.c:2587 (discriminator 1)
> [<     inline     >] slab_free mm/slub.c:2736
> [<      none      >] kmem_cache_free+0x161/0x180 mm/slub.c:2745
> [<     inline     >] sk_prot_free net/core/sock.c:1374
> [<      none      >] sk_destruct+0x2e9/0x400 net/core/sock.c:1452
> [<      none      >] __sk_free+0x57/0x200 net/core/sock.c:1460
> [<      none      >] sk_free+0x30/0x40 net/core/sock.c:1471
> [<     inline     >] sock_put include/net/sock.h:1593
> [<      none      >] unix_dgram_sendmsg+0xeaf/0x1100 net/unix/af_unix.c:1571
> [<     inline     >] sock_sendmsg_nosec net/socket.c:610
> [<      none      >] sock_sendmsg+0xca/0x110 net/socket.c:620
> [<      none      >] sock_write_iter+0x216/0x3a0 net/socket.c:819
> [<     inline     >] new_sync_write fs/read_write.c:478
> [<      none      >] __vfs_write+0x2ed/0x3d0 fs/read_write.c:491
> [<      none      >] vfs_write+0x173/0x4a0 fs/read_write.c:538
> [<     inline     >] SYSC_write fs/read_write.c:585
> [<      none      >] SyS_write+0x108/0x220 fs/read_write.c:577
> [<      none      >] entry_SYSCALL_64_fastpath+0x31/0x95
> arch/x86/entry/entry_64.S:187

Probably the issue discussed in

  http://thread.gmane.org/gmane.linux.kernel/2057497/

and previous related threads.

Michal Kubecek

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1244635

FromDmitry Vyukov <dvyukov@google.com>
Date2015-10-12 14:20 +0200
Message-ID<qiKf8-74w-7@gated-at.bofh.it>
In reply to#1244629
On Mon, Oct 12, 2015 at 2:14 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On Mon, 2015-10-12 at 14:02 +0200, Michal Kubecek wrote:
>
>> Probably the issue discussed in
>>
>>   http://thread.gmane.org/gmane.linux.kernel/2057497/
>>
>> and previous related threads.
>>
>
> Same issue, but Dmitry apparently did not trust me.

Just wanted to make sure. Let's consider this as fixed.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1244636

FromEric Dumazet <eric.dumazet@gmail.com>
Date2015-10-12 14:20 +0200
Message-ID<qiKf8-74w-9@gated-at.bofh.it>
In reply to#1244629
On Mon, 2015-10-12 at 14:02 +0200, Michal Kubecek wrote:

> Probably the issue discussed in
> 
>   http://thread.gmane.org/gmane.linux.kernel/2057497/
> 
> and previous related threads.
> 

Same issue, but Dmitry apparently did not trust me.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web