Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751979AbbKZKcC (ORCPT ); Thu, 26 Nov 2015 05:32:02 -0500 Received: from mail-wm0-f54.google.com ([74.125.82.54]:37376 "EHLO mail-wm0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750801AbbKZKb6 (ORCPT ); Thu, 26 Nov 2015 05:31:58 -0500 MIME-Version: 1.0 From: Dmitry Vyukov Date: Thu, 26 Nov 2015 11:31:37 +0100 Message-ID: Subject: use-after-free in tty_check_change To: Greg Kroah-Hartman , Jiri Slaby , LKML Cc: syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin , Eric Dumazet Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3998 Lines: 102 Hello, The following program causes a use-after-free in tty_check_change: // autogenerated by syzkaller (http://github.com/google/syzkaller) #include #include #include #include void *thr(void *arg) { int x = 0; ioctl((int)(long)arg, TIOCGETD, &x); return 0; } void tty() { int fd = open("/dev/ptmx", O_RDONLY|O_SYNC); pthread_t th; pthread_create(&th, 0, thr, (void*)(long)fd); int x = 16; ioctl(fd, TIOCSETD, &x); pthread_join(th, 0); } int main() { int i; for (i = 0; i < 10; i++) { if (fork() == 0) { tty(); return 0; } } return 0; } ================================================================== BUG: KASAN: use-after-free in tty_ioctl+0x1f06/0x2140 at addr ffff880061aa0968 Read of size 8 by task a.out/6241 ============================================================================= BUG kmalloc-16 (Not tainted): kasan: bad access detected ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in tty_ldisc_get.part.3+0x66/0x140 age=6 cpu=3 pid=6230 [< none >] kmem_cache_alloc_trace+0x1cf/0x220 mm/slub.c:2589 [< none >] tty_ldisc_get.part.3+0x66/0x140 drivers/tty/tty_ldisc.c:172 [< none >] tty_set_ldisc+0x83d/0xa70 drivers/tty/tty_ldisc.c:574 [< none >] tty_ioctl+0xb2a/0x2140 drivers/tty/tty_io.c:2865 [< inline >] spin_unlock include/linux/spinlock.h:347 [< inline >] ioctl_fionbio fs/ioctl.c:492 [< none >] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:572 [< none >] SyS_ioctl+0x8f/0xc0 fs/readdir.c:25 [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 INFO: Freed in tty_set_ldisc+0x4c2/0xa70 age=12 cpu=3 pid=6230 [< none >] kfree+0x199/0x1b0 mm/slub.c:3632 [< inline >] tty_ldisc_restore drivers/tty/tty_ldisc.c:493 [< none >] tty_set_ldisc+0x4c2/0xa70 drivers/tty/tty_ldisc.c:571 [< none >] tty_ioctl+0xb2a/0x2140 drivers/tty/tty_io.c:2865 [< inline >] spin_unlock include/linux/spinlock.h:347 [< inline >] ioctl_fionbio fs/ioctl.c:492 [< none >] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:572 [< none >] SyS_ioctl+0x8f/0xc0 fs/readdir.c:25 [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 INFO: Slab 0xffffea000186a800 objects=23 used=19 fp=0xffff880061aa12d0 flags=0x5fffc0000004080 INFO: Object 0xffff880061aa0968 @offset=2408 fp=0xffff880061aa0810 CPU: 2 PID: 6241 Comm: a.out Tainted: G B 4.4.0-rc1+ #117 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 00000000ffffffff ffff88006db0fab8 ffffffff827450f6 ffff88003e807980 ffff880061aa0968 ffff880061aa0000 ffff88006db0fae8 ffffffff81629404 ffff88003e807980 ffffea000186a800 ffff880061aa0968 000000000000001b Call Trace: [] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:280 [< inline >] tty_check_change drivers/tty/tty_io.c:399 [] tty_ioctl+0x1f06/0x2140 drivers/tty/tty_io.c:2831 [< inline >] spin_unlock include/linux/spinlock.h:347 [< inline >] ioctl_fionbio fs/ioctl.c:492 [] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:572 [] SyS_ioctl+0x8f/0xc0 fs/readdir.c:25 [] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 ================================================================== On commit 6ffeba9607343f15303a399bc402a538800d89d9 (Nov 24). -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/