On Tue, Mar 2, 2021 at 12:01 PM syzbot
[off-list ref] wrote:
Hello,
syzbot found the following issue on:
HEAD commit: 5695e516 Merge tag 'io_uring-worker.v3-2021-02-25' of git:..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=168c27f2d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=e33ab2de74f48295
dashboard link: https://syzkaller.appspot.com/bug?extid=9ec037722d2603a9f52e
compiler: Debian clang version 11.0.1-2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: <redacted>
==================================================================
BUG: KASAN: use-after-free in cipso_v4_genopt+0x1078/0x1700 net/ipv4/cipso_ipv4.c:1784
Read of size 1 at addr ffff888017bba510 by task kworker/1:3/4821
CPU: 1 PID: 4821 Comm: kworker/1:3 Not tainted 5.11.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events p9_write_work
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x125/0x19e lib/dump_stack.c:120
print_address_description+0x5f/0x3a0 mm/kasan/report.c:232
__kasan_report mm/kasan/report.c:399 [inline]
kasan_report+0x15e/0x210 mm/kasan/report.c:416
cipso_v4_genopt+0x1078/0x1700 net/ipv4/cipso_ipv4.c:1784
cipso_v4_sock_setattr+0x7c/0x460 net/ipv4/cipso_ipv4.c:1866
netlbl_sock_setattr+0x28e/0x2f0 net/netlabel/netlabel_kapi.c:995
smack_netlbl_add security/smack/smack_lsm.c:2404 [inline]
smack_socket_post_create+0x13b/0x280 security/smack/smack_lsm.c:2774
security_socket_post_create+0x6f/0xd0 security/security.c:2122
__sock_create+0x62f/0x8c0 net/socket.c:1424
udp_sock_create4+0x73/0x5f0 net/ipv4/udp_tunnel_core.c:20
udp_sock_create include/net/udp_tunnel.h:59 [inline]
rxrpc_open_socket net/rxrpc/local_object.c:129 [inline]
103 more quoted lines
Besides these 2 crashes, we've also seen one on a 4.19 based kernel, see below.
Based on the reports with mismatching stacks, it looks like
cipso_v4_genopt is doing some kind of wild pointer access (uninit
pointer?).
netlink: 'syz-executor.0': attribute type 4 has an invalid length.
==================================================================
BUG: KASAN: use-after-free in
cipso_v4_genopt.part.0.constprop.0+0x11f3/0x1400
net/ipv4/cipso_ipv4.c:1795
Read of size 1 at addr ffff8881f41bb790 by task syz-executor.1/7116
CPU: 0 PID: 7116 Comm: syz-executor.1 Not tainted
4.19.121-syzkaller-00217-g3b679299c55f #0
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x10d/0x199 lib/dump_stack.c:118
print_address_description.cold+0x54/0x204 mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.part.0.cold+0x187/0x2db mm/kasan/report.c:412
cipso_v4_genopt.part.0.constprop.0+0x11f3/0x1400 net/ipv4/cipso_ipv4.c:1795
cipso_v4_genopt net/ipv4/cipso_ipv4.c:1786 [inline]
cipso_v4_sock_setattr+0x7b/0x450 net/ipv4/cipso_ipv4.c:1877
netlbl_sock_setattr+0x1cd/0x2a0 net/netlabel/netlabel_kapi.c:1003
smack_netlabel+0x13a/0x180 security/smack/smack_lsm.c:2511
smack_socket_post_create security/smack/smack_lsm.c:2852 [inline]
smack_socket_post_create+0xd0/0x190 security/smack/smack_lsm.c:2830
security_socket_post_create+0x69/0xc0 security/security.c:1381
__sock_create+0x5ba/0x740 net/socket.c:1292
sock_create net/socket.c:1316 [inline]
__sys_socket+0xf4/0x200 net/socket.c:1346
__do_sys_socket net/socket.c:1355 [inline]
__se_sys_socket net/socket.c:1353 [inline]
__x64_sys_socket+0x74/0xb0 net/socket.c:1353
do_syscall_64+0xbc/0x130 arch/x86/entry/common.c:293
74 more lines
ffff8881f41bb780: fb fb fb fb fb fb fb fb fc fc fc fc 00 00 00 00
^
ffff8881f41bb800: 00 00 fc fc fc fc fc fc 00 00 00 00 00 00 fc fc
ffff8881f41bb880: fc fc fc fc 00 00 00 00 00 00 fc fc fc fc fc fc
==================================================================