Re: general protection fault in skb_release_data

5 messages, 4 authors, 2017-05-22 · open the first message on its own page

Re: general protection fault in skb_release_data

From: Andrey Konovalov <hidden>
Date: 2017-05-19 12:57:30 

On Fri, May 19, 2017 at 12:18 PM,  [off-list ref] wrote:
Hi,

I've got the following bug report while fuzzing the
kernel(master-f83246089ca) with syzkaller.

program and config are attached.
Hi!

Thanks for the report!

Adding kernel maintainers.

I can confirm that we've hist this bug multiple times, but never been
able to reproduce it.

I was able to reproduce it on 2ea659a9ef488125eb46da6eb571de5eae5c43f6
(4.12-rc1).

Using the attached syzkaller program I was able to generate C
reproducer, attached. Sometimes I need to run it a few times to
trigger the bug.

@idaifish If you find more bugs please run ./scripts/get_maintainer.pl
to get the list of subsystem maintainers and add them to the
recipients. I've updated instructions of how to report kernel bugs
found with syzkaller in README.

Thanks!

=======================================================
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 2 PID: 21599 Comm: syz-executor3 Not tainted 4.11.0-rc8+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
task: ffff88006c16dec0 task.stack: ffff880058bb8000
RIP: 0010:__read_once_size include/linux/compiler.h:254 [inline]
RIP: 0010:compound_head include/linux/page-flags.h:146 [inline]
RIP: 0010:put_page include/linux/mm.h:796 [inline]
RIP: 0010:__skb_frag_unref include/linux/skbuff.h:2613 [inline]
RIP: 0010:skb_release_data+0x201/0x3b0 net/core/skbuff.c:593
RSP: 0018:ffff880058bbf570 EFLAGS: 00010a02
RAX: 11032b488bad1523 RBX: ffff88006c6e8ec8 RCX: ffffc9000190e000
RDX: 1ffff1000d8dd1df RSI: ffffffff8293d7e3 RDI: 88195a445d68a919
RBP: ffff880058bbf5a8 R08: 7bdf27567b31597f R09: 0000000000000000
R10: 00000000000000d2 R11: 7dc9ab6dec891f24 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff88006a475940 R15: 88195a445d68a8f9
FS:  00007fbbc6a34700(0000) GS:ffff88006e400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002004e000 CR3: 000000006b868000 CR4: 00000000000006e0
Call Trace:
 skb_release_all+0x4a/0x60 net/core/skbuff.c:669
 __kfree_skb net/core/skbuff.c:683 [inline]
 kfree_skb+0x85/0x1b0 net/core/skbuff.c:704
 __ip6_append_data.isra.42+0x26ed/0x33b0 net/ipv6/ip6_output.c:1519
 ip6_append_data+0x1a8/0x2f0 net/ipv6/ip6_output.c:1633
 udpv6_sendmsg+0x7bd/0x2360 net/ipv6/udp.c:1264
 inet_sendmsg+0x123/0x3a0 net/ipv4/af_inet.c:762
 sock_sendmsg_nosec net/socket.c:633 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:643
 ___sys_sendmsg+0x79f/0x900 net/socket.c:1997
 __sys_sendmsg+0xd1/0x170 net/socket.c:2031
 SYSC_sendmsg net/socket.c:2042 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2038
 entry_SYSCALL_64_fastpath+0x1a/0xa9
RIP: 0033:0x44fb79
RSP: 002b:00007fbbc6a33b58 EFLAGS: 00000212 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000044fb79
RDX: 0000000000000000 RSI: 000000002000afc8 RDI: 0000000000000005
RBP: 00000000000003fb R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000005
R13: 0000000020001000 R14: 0000000000048000 R15: 0000000000000000
Code: 48 83 c0 03 48 c1 e0 04 48 01 d8 48 89 c2 48 c1 ea 03 42 80 3c 2a 00
0f 85 92 01 00 00 4c 8b 38 49 8d 7f 20 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00
0f 85 6f 01 00 00 49 8b 47 20 a8 01 0f 84 3b ff
RIP: __read_once_size include/linux/compiler.h:254 [inline] RSP:
ffff880058bbf570
RIP: compound_head include/linux/page-flags.h:146 [inline] RSP:
ffff880058bbf570
RIP: put_page include/linux/mm.h:796 [inline] RSP: ffff880058bbf570
RIP: __skb_frag_unref include/linux/skbuff.h:2613 [inline] RSP:
ffff880058bbf570
RIP: skb_release_data+0x201/0x3b0 net/core/skbuff.c:593 RSP:
ffff880058bbf570
---[ end trace 46c9f72a66cd8627 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

--
You received this message because you are subscribed to the Google Groups
"syzkaller" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to syzkaller+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: general protection fault in skb_release_data

From: Eric Dumazet <edumazet@google.com>
Date: 2017-05-19 14:36:34 

On Fri, May 19, 2017 at 5:57 AM, Andrey Konovalov [off-list ref] wrote:
On Fri, May 19, 2017 at 12:18 PM,  [off-list ref] wrote:
quoted
Hi,

I've got the following bug report while fuzzing the
kernel(master-f83246089ca) with syzkaller.

program and config are attached.
Hi!

Thanks for the report!

Adding kernel maintainers.

I can confirm that we've hist this bug multiple times, but never been
able to reproduce it.

I was able to reproduce it on 2ea659a9ef488125eb46da6eb571de5eae5c43f6
(4.12-rc1).

Using the attached syzkaller program I was able to generate C
reproducer, attached. Sometimes I need to run it a few times to
trigger the bug.

@idaifish If you find more bugs please run ./scripts/get_maintainer.pl
to get the list of subsystem maintainers and add them to the
recipients. I've updated instructions of how to report kernel bugs
found with syzkaller in README.

Thanks!
quoted
=======================================================
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 2 PID: 21599 Comm: syz-executor3 Not tainted 4.11.0-rc8+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
task: ffff88006c16dec0 task.stack: ffff880058bb8000
RIP: 0010:__read_once_size include/linux/compiler.h:254 [inline]
RIP: 0010:compound_head include/linux/page-flags.h:146 [inline]
RIP: 0010:put_page include/linux/mm.h:796 [inline]
RIP: 0010:__skb_frag_unref include/linux/skbuff.h:2613 [inline]
RIP: 0010:skb_release_data+0x201/0x3b0 net/core/skbuff.c:593
RSP: 0018:ffff880058bbf570 EFLAGS: 00010a02
RAX: 11032b488bad1523 RBX: ffff88006c6e8ec8 RCX: ffffc9000190e000
RDX: 1ffff1000d8dd1df RSI: ffffffff8293d7e3 RDI: 88195a445d68a919
RBP: ffff880058bbf5a8 R08: 7bdf27567b31597f R09: 0000000000000000
R10: 00000000000000d2 R11: 7dc9ab6dec891f24 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff88006a475940 R15: 88195a445d68a8f9
FS:  00007fbbc6a34700(0000) GS:ffff88006e400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002004e000 CR3: 000000006b868000 CR4: 00000000000006e0
Call Trace:
 skb_release_all+0x4a/0x60 net/core/skbuff.c:669
 __kfree_skb net/core/skbuff.c:683 [inline]
 kfree_skb+0x85/0x1b0 net/core/skbuff.c:704
 __ip6_append_data.isra.42+0x26ed/0x33b0 net/ipv6/ip6_output.c:1519
 ip6_append_data+0x1a8/0x2f0 net/ipv6/ip6_output.c:1633
 udpv6_sendmsg+0x7bd/0x2360 net/ipv6/udp.c:1264
 inet_sendmsg+0x123/0x3a0 net/ipv4/af_inet.c:762
 sock_sendmsg_nosec net/socket.c:633 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:643
 ___sys_sendmsg+0x79f/0x900 net/socket.c:1997
 __sys_sendmsg+0xd1/0x170 net/socket.c:2031
 SYSC_sendmsg net/socket.c:2042 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2038
 entry_SYSCALL_64_fastpath+0x1a/0xa9
RIP: 0033:0x44fb79
RSP: 002b:00007fbbc6a33b58 EFLAGS: 00000212 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000044fb79
RDX: 0000000000000000 RSI: 000000002000afc8 RDI: 0000000000000005
RBP: 00000000000003fb R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000005
R13: 0000000020001000 R14: 0000000000048000 R15: 0000000000000000
Code: 48 83 c0 03 48 c1 e0 04 48 01 d8 48 89 c2 48 c1 ea 03 42 80 3c 2a 00
0f 85 92 01 00 00 4c 8b 38 49 8d 7f 20 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00
0f 85 6f 01 00 00 49 8b 47 20 a8 01 0f 84 3b ff
RIP: __read_once_size include/linux/compiler.h:254 [inline] RSP:
ffff880058bbf570
RIP: compound_head include/linux/page-flags.h:146 [inline] RSP:
ffff880058bbf570
RIP: put_page include/linux/mm.h:796 [inline] RSP: ffff880058bbf570
RIP: __skb_frag_unref include/linux/skbuff.h:2613 [inline] RSP:
ffff880058bbf570
RIP: skb_release_data+0x201/0x3b0 net/core/skbuff.c:593 RSP:
ffff880058bbf570
---[ end trace 46c9f72a66cd8627 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

--
You received this message because you are subscribed to the Google Groups
"syzkaller" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to syzkaller+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
Hi Andrey, please try following patch
Thanks.

Re: general protection fault in skb_release_data

From: Andrey Konovalov <hidden>
Date: 2017-05-19 14:50:46 

On Fri, May 19, 2017 at 4:36 PM, 'Eric Dumazet' via syzkaller
[off-list ref] wrote:
On Fri, May 19, 2017 at 5:57 AM, Andrey Konovalov [off-list ref] wrote:
quoted
On Fri, May 19, 2017 at 12:18 PM,  [off-list ref] wrote:
quoted
Hi,

I've got the following bug report while fuzzing the
kernel(master-f83246089ca) with syzkaller.

program and config are attached.
Hi!

Thanks for the report!

Adding kernel maintainers.

I can confirm that we've hist this bug multiple times, but never been
able to reproduce it.

I was able to reproduce it on 2ea659a9ef488125eb46da6eb571de5eae5c43f6
(4.12-rc1).

Using the attached syzkaller program I was able to generate C
reproducer, attached. Sometimes I need to run it a few times to
trigger the bug.

@idaifish If you find more bugs please run ./scripts/get_maintainer.pl
to get the list of subsystem maintainers and add them to the
recipients. I've updated instructions of how to report kernel bugs
found with syzkaller in README.

Thanks!
quoted
=======================================================
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 2 PID: 21599 Comm: syz-executor3 Not tainted 4.11.0-rc8+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
task: ffff88006c16dec0 task.stack: ffff880058bb8000
RIP: 0010:__read_once_size include/linux/compiler.h:254 [inline]
RIP: 0010:compound_head include/linux/page-flags.h:146 [inline]
RIP: 0010:put_page include/linux/mm.h:796 [inline]
RIP: 0010:__skb_frag_unref include/linux/skbuff.h:2613 [inline]
RIP: 0010:skb_release_data+0x201/0x3b0 net/core/skbuff.c:593
RSP: 0018:ffff880058bbf570 EFLAGS: 00010a02
RAX: 11032b488bad1523 RBX: ffff88006c6e8ec8 RCX: ffffc9000190e000
RDX: 1ffff1000d8dd1df RSI: ffffffff8293d7e3 RDI: 88195a445d68a919
RBP: ffff880058bbf5a8 R08: 7bdf27567b31597f R09: 0000000000000000
R10: 00000000000000d2 R11: 7dc9ab6dec891f24 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff88006a475940 R15: 88195a445d68a8f9
FS:  00007fbbc6a34700(0000) GS:ffff88006e400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002004e000 CR3: 000000006b868000 CR4: 00000000000006e0
Call Trace:
 skb_release_all+0x4a/0x60 net/core/skbuff.c:669
 __kfree_skb net/core/skbuff.c:683 [inline]
 kfree_skb+0x85/0x1b0 net/core/skbuff.c:704
 __ip6_append_data.isra.42+0x26ed/0x33b0 net/ipv6/ip6_output.c:1519
 ip6_append_data+0x1a8/0x2f0 net/ipv6/ip6_output.c:1633
 udpv6_sendmsg+0x7bd/0x2360 net/ipv6/udp.c:1264
 inet_sendmsg+0x123/0x3a0 net/ipv4/af_inet.c:762
 sock_sendmsg_nosec net/socket.c:633 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:643
 ___sys_sendmsg+0x79f/0x900 net/socket.c:1997
 __sys_sendmsg+0xd1/0x170 net/socket.c:2031
 SYSC_sendmsg net/socket.c:2042 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2038
 entry_SYSCALL_64_fastpath+0x1a/0xa9
RIP: 0033:0x44fb79
RSP: 002b:00007fbbc6a33b58 EFLAGS: 00000212 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 000000000044fb79
RDX: 0000000000000000 RSI: 000000002000afc8 RDI: 0000000000000005
RBP: 00000000000003fb R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000005
R13: 0000000020001000 R14: 0000000000048000 R15: 0000000000000000
Code: 48 83 c0 03 48 c1 e0 04 48 01 d8 48 89 c2 48 c1 ea 03 42 80 3c 2a 00
0f 85 92 01 00 00 4c 8b 38 49 8d 7f 20 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00
0f 85 6f 01 00 00 49 8b 47 20 a8 01 0f 84 3b ff
RIP: __read_once_size include/linux/compiler.h:254 [inline] RSP:
ffff880058bbf570
RIP: compound_head include/linux/page-flags.h:146 [inline] RSP:
ffff880058bbf570
RIP: put_page include/linux/mm.h:796 [inline] RSP: ffff880058bbf570
RIP: __skb_frag_unref include/linux/skbuff.h:2613 [inline] RSP:
ffff880058bbf570
RIP: skb_release_data+0x201/0x3b0 net/core/skbuff.c:593 RSP:
ffff880058bbf570
---[ end trace 46c9f72a66cd8627 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

--
You received this message because you are subscribed to the Google Groups
"syzkaller" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to syzkaller+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
Hi Andrey, please try following patch
Thanks.
Hi Eric,

Your patch fixes the bug for me.

Thanks!

Tested-by: Andrey Konovalov <redacted>

--
You received this message because you are subscribed to the Google Groups "syzkaller" group.
To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[PATCH net] ipv6: fix out of bound writes in __ip6_append_data()

From: Eric Dumazet <hidden>
Date: 2017-05-19 21:17:50 

From: Eric Dumazet <edumazet@google.com>

Andrey Konovalov and idaifish@gmail.com reported crashes caused by
one skb shared_info being overwritten from __ip6_append_data()

Andrey program lead to following state :

copy -4200 datalen 2000 fraglen 2040 
maxfraglen 2040 alloclen 2048 transhdrlen 0 offset 0 fraggap 6200

The skb_copy_and_csum_bits(skb_prev, maxfraglen, data + transhdrlen,
fraggap, 0); is overwriting skb->head and skb_shared_info

Since we apparently detect this rare condition too late, move the
code earlier to even avoid allocating skb and risking crashes.

Once again, many thanks to Andrey and syzkaller team.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <redacted>
Tested-by: Andrey Konovalov <redacted>
Reported-by: <redacted>
---
 net/ipv6/ip6_output.c |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index d4a31becbd25dda895d7391e1e65c2de237bf2a3..bf8a58a1c32d83a9605844075da5815be23a6bf1 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1466,6 +1466,11 @@ static int __ip6_append_data(struct sock *sk,
 			 */
 			alloclen += sizeof(struct frag_hdr);
 
+			copy = datalen - transhdrlen - fraggap;
+			if (copy < 0) {
+				err = -EINVAL;
+				goto error;
+			}
 			if (transhdrlen) {
 				skb = sock_alloc_send_skb(sk,
 						alloclen + hh_len,
@@ -1515,13 +1520,9 @@ static int __ip6_append_data(struct sock *sk,
 				data += fraggap;
 				pskb_trim_unique(skb_prev, maxfraglen);
 			}
-			copy = datalen - transhdrlen - fraggap;
-
-			if (copy < 0) {
-				err = -EINVAL;
-				kfree_skb(skb);
-				goto error;
-			} else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
+			if (copy > 0 &&
+			    getfrag(from, data + transhdrlen, offset,
+				    copy, fraggap, skb) < 0) {
 				err = -EFAULT;
 				kfree_skb(skb);
 				goto error;

Re: [PATCH net] ipv6: fix out of bound writes in __ip6_append_data()

From: David Miller <davem@davemloft.net>
Date: 2017-05-22 15:49:41 

From: Eric Dumazet <redacted>
Date: Fri, 19 May 2017 14:17:48 -0700

From: Eric Dumazet <edumazet@google.com>

Andrey Konovalov and idaifish@gmail.com reported crashes caused by
one skb shared_info being overwritten from __ip6_append_data()

Andrey program lead to following state :

copy -4200 datalen 2000 fraglen 2040 
maxfraglen 2040 alloclen 2048 transhdrlen 0 offset 0 fraggap 6200

The skb_copy_and_csum_bits(skb_prev, maxfraglen, data + transhdrlen,
fraggap, 0); is overwriting skb->head and skb_shared_info

Since we apparently detect this rare condition too late, move the
code earlier to even avoid allocating skb and risking crashes.

Once again, many thanks to Andrey and syzkaller team.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <redacted>
Tested-by: Andrey Konovalov <redacted>
Reported-by: <redacted>
Looks good, applied and queued up for -stable.

Thanks Eric.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help