Bug 195807 - general protection fault in ping_v4_sendmsg
Summary: general protection fault in ping_v4_sendmsg
Status: RESOLVED PATCH_ALREADY_AVAILABLE
Alias: None
Product: Networking
Classification: Unclassified
Component: IPV4 (show other bugs)
Hardware: x86-64 Linux
: P1 high
Assignee: Stephen Hemminger
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-18 03:36 UTC by youwei
Modified: 2018-01-10 14:11 UTC (History)
2 users (show)

See Also:
Kernel Version: 4.4 to 4.10-rc7
Subsystem:
Regression: No
Bisected commit-id:


Attachments
poc and kernel config (31.51 KB, application/x-gzip)
2017-05-18 03:36 UTC, youwei
Details

Description youwei 2017-05-18 03:36:33 UTC
Created attachment 256607 [details]
poc and kernel config

I got a general protection fault (use after free) when fuzzing the bpf system call.
Attached is the PoC that can reproduce this issue in kernel version from 4.4 to 4.10-rc7.

Following is the dmesg output when executing the PoC on kernel version 4.10-rc7
[   32.949367] kasan: CONFIG_KASAN_INLINE enabled
[   32.949915] kasan: GPF could be caused by NULL-ptr deref or user memory access
[   32.950602] general protection fault: 0000 [#1] SMP KASAN
[   32.951089] Dumping ftrace buffer:
[   32.951396]    (ftrace buffer empty)
[   32.951579] Modules linked in:
[   32.951579] CPU: 0 PID: 4145 Comm: poc-NB1 Not tainted 4.10.0-rc7 #1
[   32.951579] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014
[   32.951579] task: ffff880064f51bc0 task.stack: ffff880056568000
[   32.951579] RIP: 0010:ping_v4_sendmsg+0xcbd/0x1240
[   32.951579] RSP: 0018:ffff88005656f9b8 EFLAGS: 00010206
[   32.951579] RAX: dffffc0000000000 RBX: ffff88005656fc20 RCX: 1ffff1000a9ad033
[   32.951579] RDX: 0000000000000018 RSI: 0000000000000008 RDI: 00000000000000c2
[   32.951579] RBP: ffff88005656fc48 R08: 0000000000000008 R09: 0000000000000000
[   32.951579] R10: 000000000100007f R11: 0000000000000000 R12: ffff880054d68040
[   32.951579] R13: 0000000000000000 R14: ffff88005656fb40 R15: ffff88005656fac0
[   32.951579] FS:  00007fc22df907c0(0000) GS:ffff88006ca00000(0000) knlGS:0000000000000000
[   32.951579] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   32.951579] CR2: 0000000020007000 CR3: 00000000656e0000 CR4: 00000000000006f0
[   32.951579] Call Trace:
[   32.951579]  ? ping_queue_rcv_skb+0x60/0x60
[   32.951579]  ? depot_save_stack+0x133/0x4a0
[   32.951579]  ? save_stack+0xb1/0xd0
[   32.951579]  ? save_stack_trace+0x16/0x20
[   32.951579]  ? save_stack+0x46/0xd0
[   32.951579]  ? __anon_vma_prepare+0x30e/0x570
[   32.951579]  ? handle_mm_fault+0xdb0/0x1e30
[   32.951579]  ? __do_page_fault+0x5b9/0xc50
[   32.951579]  ? do_page_fault+0x2a/0x30
[   32.951579]  ? page_fault+0x22/0x30
[   32.951579]  ? ip4_datagram_release_cb+0xf3/0x6e0
[   32.951579]  ? _raw_write_unlock_bh+0x3c/0x50
[   32.951579]  ? ping_get_port+0x37d/0x5e0
[   32.951579]  ? _raw_spin_unlock_bh+0x3c/0x50
[   32.951579]  ? release_sock+0x194/0x1d0
[   32.951579]  inet_sendmsg+0x141/0x3e0
[   32.951579]  ? inet_recvmsg+0x430/0x430
[   32.951579]  sock_sendmsg+0xde/0x120
[   32.951579]  SYSC_sendto+0x23f/0x3a0
[   32.951579]  ? SYSC_connect+0x320/0x320
[   32.951579]  ? __page_set_anon_rmap+0x1cc/0x2b0
[   32.951579]  ? __lru_cache_add+0x114/0x1a0
[   32.951579]  ? handle_mm_fault+0x6ff/0x1e30
[   32.951579]  ? get_unused_fd_flags+0xd0/0xd0
[   32.951579]  ? find_vma+0x3f/0x190
[   32.951579]  ? __do_page_fault+0x3ae/0xc50
[   32.951579]  SyS_sendto+0x4a/0x60
[   32.951579]  entry_SYSCALL_64_fastpath+0x13/0x94
[   32.951579] RIP: 0033:0x7fc22dac6b79
[   32.951579] RSP: 002b:00007ffc4ecef988 EFLAGS: 00000206 ORIG_RAX: 000000000000002c
[   32.951579] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc22dac6b79
[   32.951579] RDX: 0000000000000008 RSI: 0000000020004ff5 RDI: 0000000000000003
[   32.951579] RBP: 00007ffc4ecefa00 R08: 0000000020007000 R09: 0000000000000010
[   32.951579] R10: 400000000000083c R11: 0000000000000206 R12: 0000000000400b20
[   32.951579] R13: 00007ffc4ecefb30 R14: 0000000000000000 R15: 0000000000000000
[   32.951579] Code: ff c1 e2 10 66 31 c0 01 d0 15 ff ff 00 00 f7 d0 48 89 fa c1 e8 10 48 c1 ea 03 66 89 83 a2 fe ff ff 48 b8 00 00 00 00 00 fc ff df <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85
[   32.951579] RIP: ping_v4_sendmsg+0xcbd/0x1240 RSP: ffff88005656f9b8
[   32.978078] ---[ end trace 3d206c2ba5fde6a4 ]---
[   32.978505] Kernel panic - not syncing: Fatal exception
[   32.979052] Dumping ftrace buffer:
[   32.979052]    (ftrace buffer empty)
[   32.979052] Kernel Offset: disabled
[   32.979052] Rebooting in 86400 seconds..
Comment 1 Eric Dumazet 2017-05-18 15:31:26 UTC
Why 4.10-rc7 ?

What about 4.11 kernel, has it the problem ?

git describe --contains 43a6684519ab0a6c52024b5e25322476cabad893
v4.11-rc6~27^2~43
Comment 2 Dmitry Vyukov 2018-01-10 14:11:40 UTC
I think this was fixed by "ping: fix a null pointer dereference" which was reported as similar:

  general protection fault: 0000 [#1] SMP KASAN
  Dumping ftrace buffer:
     (ftrace buffer empty)
  Modules linked in:
  CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ #124
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  task: ffff880060048040 task.stack: ffff880069be8000
  RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline]
  RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837
  RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206
  RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000
  RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2
  RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000
  R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0
  R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000
  FS:  00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0
  Call Trace:
   inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
   sock_sendmsg_nosec net/socket.c:635 [inline]
   sock_sendmsg+0xca/0x110 net/socket.c:645
   SYSC_sendto+0x660/0x810 net/socket.c:1687
   SyS_sendto+0x40/0x50 net/socket.c:1655
   entry_SYSCALL_64_fastpath+0x1f/0xc2

Closing this. Please reopen if you think it's another bug.
Comment 3 Dmitry Vyukov 2018-01-10 14:11:58 UTC
ping: fix a null pointer dereference

Note You need to log in before you can comment on or make changes to this bug.