On Sat, 2015-11-28 at 09:11 -0800, Eric Dumazet wrote:

On Sat, 2015-11-28 at 12:00 +0100, Dmitry Vyukov wrote:

quoted

Hello,

The following program triggers use-after-free in ip6_setup_cork:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <syscall.h>
#include <string.h>
#include <stdint.h>
#include <pthread.h>

int r1, r3, r4;

void *thr0(void *arg)
{
        *(uint64_t*)0x20000d90 = 0x20000fd3;
        *(uint64_t*)0x20000d98 = 0x2d;
        *(uint64_t*)0x20000da0 = 0x20000fa4;
        *(uint64_t*)0x20000da8 = 0x5c;
        *(uint64_t*)0x20000db0 = 0x20000fac;
        *(uint64_t*)0x20000db8 = 0x71;
        *(uint64_t*)0x20000dc0 = 0x20000fb6;
        *(uint64_t*)0x20000dc8 = 0xec;
        *(uint64_t*)0x20000dd0 = 0x20000fae;
        *(uint64_t*)0x20000dd8 = 0x70;
        syscall(SYS_vmsplice, r4, 0x20000d90ul, 0x5ul, 0x2ul, 0, 0);
        return 0;
}

void *thr1(void *arg)
{
        memcpy((void*)0x200025e5, "\xbb\xef\x44\xd6\x33\x93", 6);
        syscall(SYS_setsockopt, r1, 0x29ul, 0x6ul, 0x200025e5ul, 0x6ul, 0);
        return 0;
}

void *thr2(void *arg)
{
        syscall(SYS_splice, r3, 0x0ul, r1, 0x0ul, 0xaful, 0x3ul);
        return 0;
}

int main()
{
        syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, 0x32ul,
0xfffffffffffffffful, 0x0ul);
        r1 = syscall(SYS_socket, 0xaul, 0x80002ul, 0x0ul, 0, 0, 0);
        syscall(SYS_pipe2, 0x20001000ul, 0x800ul, 0, 0, 0, 0);
        r3 = *(uint32_t*)0x20001000;
        r4 = *(uint32_t*)0x20001004;
        memcpy((void*)0x20003000,
"\x0a\x00\x33\xe2\x61\x44\xfe\x90\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x5b\x11\x6d\x22",
28);
        long r6 = syscall(SYS_connect, r1, 0x20003000ul, 0x1cul, 0, 0, 0);
        pthread_t th[4];
        pthread_create(&th[0], 0, thr0, 0);
        pthread_create(&th[1], 0, thr1, 0);
        pthread_create(&th[2], 0, thr2, 0);
        pthread_create(&th[3], 0, thr1, 0);
        pthread_join(th[0], 0);
        pthread_join(th[1], 0);
        pthread_join(th[2], 0);
        pthread_join(th[3], 0);
        return 0;
}


==================================================================
BUG: KASAN: use-after-free in ip6_setup_cork+0xeb8/0x11a0 at addr
ffff88006d36da08
Read of size 4 by task executor/23958
=============================================================================
BUG kmalloc-64 (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------

Disabling lock debugging due to kernel taint
INFO: Allocated in sock_kmalloc+0x7f/0xc0 age=9 cpu=3 pid=23946
[<      none      >] ___slab_alloc+0x41c/0x460 mm/slub.c:2438
[<      none      >] __slab_alloc+0x1b/0x30 mm/slub.c:2467
[<     inline     >] slab_alloc_node mm/slub.c:2530
[<     inline     >] slab_alloc mm/slub.c:2572
[<      none      >] __kmalloc+0x156/0x1b0 mm/slub.c:3532
[<     inline     >] kmalloc include/linux/slab.h:463
[<      none      >] sock_kmalloc+0x7f/0xc0 net/core/sock.c:1774
[<      none      >] do_ipv6_setsockopt.isra.8+0x779/0x2a60
net/ipv6/ipv6_sockglue.c:483
[<      none      >] ipv6_setsockopt+0x9b/0x140 net/ipv6/ipv6_sockglue.c:885
[<      none      >] udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1425
[<      none      >] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2645
[<     inline     >] SYSC_setsockopt net/socket.c:1757
[<      none      >] SyS_setsockopt+0x158/0x240 net/socket.c:1736
[<      none      >] entry_SYSCALL_64_fastpath+0x12/0x71
arch/x86/entry/entry_64.S:185

INFO: Freed in sock_kfree_s+0x29/0x70 age=11 cpu=2 pid=23957
[<      none      >] __slab_free+0x1fb/0x300 mm/slub.c:2648
[<     inline     >] slab_free mm/slub.c:2803
[<      none      >] kfree+0x13b/0x160 mm/slub.c:3632
[<     inline     >] __sock_kfree_s net/core/sock.c:1795
[<      none      >] sock_kfree_s+0x29/0x70 net/core/sock.c:1801
[<      none      >] do_ipv6_setsockopt.isra.8+0x815/0x2a60
net/ipv6/ipv6_sockglue.c:506
[<      none      >] ipv6_setsockopt+0x9b/0x140 net/ipv6/ipv6_sockglue.c:885
[<      none      >] udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1425
[<      none      >] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2645
[<     inline     >] SYSC_setsockopt net/socket.c:1757
[<      none      >] SyS_setsockopt+0x158/0x240 net/socket.c:1736
[<      none      >] entry_SYSCALL_64_fastpath+0x12/0x71
arch/x86/entry/entry_64.S:185

INFO: Slab 0xffffea0001b4db00 objects=20 used=8 fp=0xffff88006d36da08
flags=0x500000000004080
INFO: Object 0xffff88006d36da08 @offset=6664 fp=0xffff88006d36d3e8
CPU: 3 PID: 23958 Comm: executor Tainted: G    B           4.4.0-rc2+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 00000000ffffffff ffff88003c32f348 ffffffff81a2bdb0 ffff88003e807840
 ffff88006d36da08 ffff88006d36c000 ffff88003c32f378 ffffffff814541d4
 ffff88003e807840 ffffea0001b4db00 ffff88006d36da08 ffff88006d126000

Call Trace:
 [<ffffffff8145b9ae>] __asan_report_load4_noabort+0x3e/0x40
mm/kasan/report.c:279
 [<ffffffff829de1e8>] ip6_setup_cork+0xeb8/0x11a0 net/ipv6/ip6_output.c:1200
 [<ffffffff829e9e2a>] ip6_make_skb+0x19a/0x3b0 net/ipv6/ip6_output.c:1769
 [<ffffffff82a3c3e6>] udpv6_sendmsg+0x11c6/0x2120 net/ipv6/udp.c:1314
 [<ffffffff829038cc>] inet_sendmsg+0x23c/0x340 net/ipv4/af_inet.c:733
 [<     inline     >] sock_sendmsg_nosec net/socket.c:610
 [<ffffffff826adc2a>] sock_sendmsg+0xca/0x110 net/socket.c:620
 [<ffffffff826ae057>] kernel_sendmsg+0x47/0x60 net/socket.c:628
 [<ffffffff826b564a>] sock_no_sendpage+0xfa/0x130 net/core/sock.c:2270
 [<ffffffff826ac6d0>] kernel_sendpage+0x90/0xe0 net/socket.c:3278
 [<ffffffff826ac7c5>] sock_sendpage+0xa5/0xd0 net/socket.c:765
 [<ffffffff814feca4>] pipe_to_sendpage+0x264/0x320 fs/splice.c:720
 [<     inline     >] splice_from_pipe_feed fs/splice.c:772
 [<ffffffff81501435>] __splice_from_pipe+0x235/0x6d0 fs/splice.c:897
 [<ffffffff81504677>] splice_from_pipe+0xf7/0x140 fs/splice.c:932
 [<ffffffff81504700>] generic_splice_sendpage+0x40/0x50 fs/splice.c:1105
 [<     inline     >] do_splice_from fs/splice.c:1124
 [<     inline     >] do_splice fs/splice.c:1400
 [<     inline     >] SYSC_splice fs/splice.c:1703
 [<ffffffff815052f8>] SyS_splice+0x7c8/0x15c0 fs/splice.c:1686
 [<ffffffff82ddc0ae>] entry_SYSCALL_64_fastpath+0x12/0x71
arch/x86/entry/entry_64.S:185
==================================================================


On commit 78c4a49a69e910a162b05e4e8727b9bdbf948f13 (Nov 25).
--

Thanks for the report.

Bug probably added in :

commit 03485f2adcde0c2d4e9228b659be78e872486bbb
Author: Vlad Yasevich [off-list ref]
Date:   Sat Jan 31 10:40:17 2015 -0500

    udpv6: Add lockless sendmsg() support
    
    This commit adds the same functionaliy to IPv6 that
    commit 903ab86d195cca295379699299c5fc10beba31c7
    Author: Herbert Xu [off-list ref]
    Date:   Tue Mar 1 02:36:48 2011 +0000
    
        udp: Add lockless transmit path
    
    added to IPv4.
    
    UDP transmit path can now run without a socket lock,
    thus allowing multiple threads to send to a single socket
    more efficiently.
    This is only used when corking/MSG_MORE is not used.
    
    Signed-off-by: Vladislav Yasevich [off-list ref]
    Signed-off-by: David S. Miller [off-list ref]

Oh well, bug is older than that.

inet6_sk(sk)->opt handling is completely racy, and has some xchg() calls
to hide how ugly it is.