net/udp: bug in skb_pull_rcsum

From	Andrey Konovalov <andreyknvl@google.com>
Newsgroups	linux.kernel
Subject	net/udp: bug in skb_pull_rcsum
Date	2016-11-22 13:00 +0100
Message-ID	<sGhU2-6Ds-9@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi,

I've got the following error report while fuzzing the kernel with syzkaller.

A reproducer is attached.

On commit 9c763584b7c8911106bb77af7e648bef09af9d80 (4.9-rc6, Nov 20).

------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:3029!
invalid opcode: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 1 PID: 3854 Comm: a.out Not tainted 4.9.0-rc6+ #431
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880068472c00 task.stack: ffff880063ec8000
RIP: 0010:[<ffffffff82b8fd85>]  [<ffffffff82b8fd85>]
skb_pull_rcsum+0x255/0x350 net/core/skbuff.c:3029
RSP: 0018:ffff880063ecf660  EFLAGS: 00010297
RAX: ffff880068472c00 RBX: ffff880065a2da00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 000000000000000d RDI: ffffed000c7d9ec0
RBP: ffff880063ecf690 R08: 1ffff1000d08e67e R09: 1ffff1000cb45b50
R10: dffffc0000000000 R11: 0000000000000000 R12: ffff880065a2da80
R13: 0000000000000008 R14: ffff880065a2dad8 R15: 0000000000000001
FS:  00007fbb006497c0(0000) GS:ffff88006cd00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020032fe0 CR3: 00000000636d9000 CR4: 00000000000006e0
Stack:
 ffff88006bfbb948 ffff880065a2da00 ffff880064160000 1ffff1000cb45b52
 0000000000000000 1ffff1000d4d3933 ffff880063ecf6f8 ffffffff83354ced
 00000000fffffe00 ffff880065a2da90 ffff880063ecf6c0 ffffffff00000001
Call Trace:
 [<     inline     >] udp_csum_pull_header ./include/net/udp.h:166
 [<ffffffff83354ced>] udpv6_queue_rcv_skb+0x37d/0x17b0 net/ipv6/udp.c:625
 [<     inline     >] sk_backlog_rcv ./include/net/sock.h:874
 [<ffffffff82b7eec6>] __release_sock+0x126/0x3a0 net/core/sock.c:2046
 [<ffffffff82b7f199>] release_sock+0x59/0x1c0 net/core/sock.c:2504
 [<ffffffff8334fc50>] udpv6_sendmsg+0x1310/0x24a0 net/ipv6/udp.c:1273
 [<ffffffff83174fa7>] inet_sendmsg+0x317/0x4e0 net/ipv4/af_inet.c:734
 [<     inline     >] sock_sendmsg_nosec net/socket.c:621
 [<ffffffff82b7176c>] sock_sendmsg+0xcc/0x110 net/socket.c:631
 [<ffffffff82b719d1>] sock_write_iter+0x221/0x3b0 net/socket.c:829
 [<ffffffff8151e69b>] do_iter_readv_writev+0x2bb/0x3f0 fs/read_write.c:695
 [<ffffffff81520501>] do_readv_writev+0x431/0x730 fs/read_write.c:872
 [<ffffffff81520d2f>] vfs_writev+0x8f/0xc0 fs/read_write.c:911
 [<ffffffff81520e41>] do_writev+0xe1/0x240 fs/read_write.c:944
 [<     inline     >] SYSC_writev fs/read_write.c:1017
 [<ffffffff81523ca7>] SyS_writev+0x27/0x30 fs/read_write.c:1014
 [<ffffffff83fc4381>] entry_SYSCALL_64_fastpath+0x1f/0xc2
arch/x86/entry/entry_64.S:209
Code: 89 f8 49 c1 e8 03 47 0f b6 14 08 45 84 d2 74 0a 41 80 fa 03 0f
8e cf 00 00 00 80 a3 91 00 00 00 f9 e9 43 ff ff ff e8 3b 79 79 fe <0f>
0b e8 34 79 79 fe 0f 0b e8 2d 79 79 fe 48 8b 7d d0 31 d2 44
RIP  [<ffffffff82b8fd85>] skb_pull_rcsum+0x255/0x350 net/core/skbuff.c:3029
 RSP <ffff880063ecf660>
---[ end trace a5d5d2cef6a25ecb ]---
==================================================================

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

net/udp: bug in skb_pull_rcsum Andrey Konovalov <andreyknvl@google.com> - 2016-11-22 13:00 +0100
  Re: net/udp: bug in skb_pull_rcsum Eric Dumazet <edumazet@google.com> - 2016-11-22 17:50 +0100
    [PATCH net] udplite: call proper backlog handlers Eric Dumazet <eric.dumazet@gmail.com> - 2016-11-22 18:20 +0100
      Re: [PATCH net] udplite: call proper backlog handlers David Miller <davem@davemloft.net> - 2016-11-24 21:40 +0100

csiph-web