Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752640AbbKYPhw (ORCPT ); Wed, 25 Nov 2015 10:37:52 -0500 Received: from mail-wm0-f43.google.com ([74.125.82.43]:33026 "EHLO mail-wm0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752562AbbKYPhu (ORCPT ); Wed, 25 Nov 2015 10:37:50 -0500 MIME-Version: 1.0 From: Dmitry Vyukov Date: Wed, 25 Nov 2015 16:37:29 +0100 Message-ID: Subject: use-after-free in irtty_open To: Greg Kroah-Hartman , Jiri Slaby , LKML , Samuel Ortiz Cc: syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin , Eric Dumazet Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 4031 Lines: 91 Hello, The following program causes a use-after-free in irtty_open: // autogenerated by syzkaller (http://github.com/google/syzkaller) #include #include #include #include int main() { int fd = open("/dev/ptmx", O_RDONLY|O_NOCTTY); int val = 9; ioctl(fd, TIOCSETD, &val); val = 11; ioctl(fd, TIOCSETD, &val); return 0; } ================================================================== BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068 Read of size 4 by task a.out/13960 ============================================================================= BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected ----------------------------------------------------------------------------- INFO: Allocated in r3964_open+0x4a/0x630 age=4 cpu=1 pid=13960 [< inline >] kmalloc include/linux/slab.h:458 [< none >] r3964_open+0x4a/0x630 drivers/tty/n_r3964.c:950 [< none >] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447 [< none >] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567 [< inline >] tiocsetd drivers/tty/tty_io.c:2650 [< none >] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883 [< inline >] vfs_ioctl fs/ioctl.c:43 [< none >] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607 [< inline >] SYSC_ioctl fs/ioctl.c:622 [< none >] SyS_ioctl+0x74/0x80 fs/ioctl.c:613 [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 INFO: Freed in r3964_close+0x20f/0x290 age=9 cpu=1 pid=13960 [< none >] kfree+0x1a2/0x1c0 mm/slub.c:3632 [< none >] r3964_close+0x20f/0x290 drivers/tty/n_r3964.c:1052 [< none >] tty_ldisc_close.isra.1+0x85/0xc0 drivers/tty/tty_ldisc.c:471 [< none >] tty_set_ldisc+0x121/0x940 drivers/tty/tty_ldisc.c:561 [< inline >] tiocsetd drivers/tty/tty_io.c:2650 [< none >] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883 [< inline >] vfs_ioctl fs/ioctl.c:43 [< none >] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607 [< inline >] SYSC_ioctl fs/ioctl.c:622 [< none >] SyS_ioctl+0x74/0x80 fs/ioctl.c:613 [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 INFO: Slab 0xffffea0000cc7700 objects=19 used=0 fp=0xffff8800331dd068 flags=0x1fffc0000004080 INFO: Object 0xffff8800331dd068 @offset=4200 fp=0xffff8800331dfb10 CPU: 1 PID: 13960 Comm: a.out Tainted: G B 4.4.0-rc2+ #51 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 ffff8800331dc000 ffff88003eba7980 ffffffff826c8be0 ffff88003e804c80 ffff88003eba79b0 ffffffff815f1604 ffff88003e804c80 ffffea0000cc7700 ffff8800331dd068 ffff8800336a9808 ffff88003eba79d8 ffffffff815f775f Call Trace: [] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279 [] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436 [] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447 [] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567 [< inline >] tiocsetd drivers/tty/tty_io.c:2650 [] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883 [< inline >] vfs_ioctl fs/ioctl.c:43 [] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607 [< inline >] SYSC_ioctl fs/ioctl.c:622 [] SyS_ioctl+0x74/0x80 fs/ioctl.c:613 [] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 ================================================================== I am on commit 6ffeba9607343f15303a399bc402a538800d89d9 (Nov 24). Thank you -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/