Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751349AbbKZN3G (ORCPT ); Thu, 26 Nov 2015 08:29:06 -0500 Received: from mail-io0-f171.google.com ([209.85.223.171]:33115 "EHLO mail-io0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750930AbbKZN3E (ORCPT ); Thu, 26 Nov 2015 08:29:04 -0500 Subject: Re: use-after-free in tty_check_change To: Dmitry Vyukov References: <56570280.5030505@hurleysoftware.com> Cc: Greg Kroah-Hartman , Jiri Slaby , LKML , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin , Eric Dumazet From: Peter Hurley Message-ID: <5657091D.5010500@hurleysoftware.com> Date: Thu, 26 Nov 2015 08:29:01 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 7089 Lines: 166 On 11/26/2015 08:09 AM, Dmitry Vyukov wrote: > On Thu, Nov 26, 2015 at 2:00 PM, Peter Hurley wrote: >> Hi Dmitry, >> >> On 11/26/2015 05:31 AM, Dmitry Vyukov wrote: >>> Hello, >>> >>> The following program causes a use-after-free in tty_check_change: >>> >>> // autogenerated by syzkaller (http://github.com/google/syzkaller) >>> #include >>> #include >>> #include >>> #include >>> >>> void *thr(void *arg) >>> { >>> int x = 0; >>> ioctl((int)(long)arg, TIOCGETD, &x); >>> return 0; >>> } >>> >>> void tty() >>> { >>> int fd = open("/dev/ptmx", O_RDONLY|O_SYNC); >>> pthread_t th; >>> pthread_create(&th, 0, thr, (void*)(long)fd); >>> int x = 16; >>> ioctl(fd, TIOCSETD, &x); >>> pthread_join(th, 0); >>> } >>> >>> int main() >>> { >>> int i; >>> >>> for (i = 0; i < 10; i++) { >>> if (fork() == 0) { >>> tty(); >>> return 0; >>> } >>> } >>> return 0; >>> } >>> >>> >>> ================================================================== >>> BUG: KASAN: use-after-free in tty_ioctl+0x1f06/0x2140 at addr ffff880061aa0968 >>> Read of size 8 by task a.out/6241 >>> ============================================================================= >>> BUG kmalloc-16 (Not tainted): kasan: bad access detected >>> ----------------------------------------------------------------------------- >> >> Thanks for the report. I think I have the patch that fixes this in >> my out-queue as part of a larger patchset. >> >> However, the stack backtrace below and the reported eip don't correspond >> to the what I think the problem is: >> >> >>> BUG: KASAN: use-after-free in tty_ioctl+0x1f06/0x2140 at addr ffff880061aa0968 >> ^^^^^^^^^^^^^^ >> this offset is off the end of compilation unit for me with gcc 4.8.4 >> >> Could you generate a mixed listing file of drivers/tty/tty_io.c and attach >> it please? > > > The source is plain 6ffeba9607343f15303a399bc402a538800d89d9, but I > use CONFIG_KASAN=y, CONFIG_KASAN_INLINE=y and gcc version 6.0.0 > 20151014. KASAN does affect generated code significantly. > Line numbers in the report should be correct. current->signal? I doubt it. Also note the stack trace pulls the wrong symbol: should be __tty_check_change on line 399, not tty_check_change(). >>> Call Trace: >>> [] __asan_report_load8_noabort+0x3e/0x40 >>> mm/kasan/report.c:280 >>> [< inline >] tty_check_change drivers/tty/tty_io.c:399 ^^^^^^^^^^^^ | +------------------------------------------+ | | $ git blame -L393,409 -s 6ffeba960734 -- drivers/tty/tty_io.c 2812d9e9 drivers/tty/tty_io.c 393) int __tty_check_change(struct tty_struct *tty, int sig) ^1da177e drivers/char/tty_io.c 394) { 47f86834 drivers/char/tty_io.c 395) unsigned long flags; 2812d9e9 drivers/tty/tty_io.c 396) struct pid *pgrp, *tty_pgrp; 47f86834 drivers/char/tty_io.c 397) int ret = 0; 47f86834 drivers/char/tty_io.c 398) ^1da177e drivers/char/tty_io.c 399) if (current->signal->tty != tty) <<<==== ??? ^1da177e drivers/char/tty_io.c 400) return 0; 47f86834 drivers/char/tty_io.c 401) 6719693c drivers/tty/tty_io.c 402) rcu_read_lock(); 6719693c drivers/tty/tty_io.c 403) pgrp = task_pgrp(current); 6719693c drivers/tty/tty_io.c 404) 47f86834 drivers/char/tty_io.c 405) spin_lock_irqsave(&tty->ctrl_lock, flags); 2812d9e9 drivers/tty/tty_io.c 406) tty_pgrp = tty->pgrp; 9ffee4cb drivers/char/tty_io.c 407) spin_unlock_irqrestore(&tty->ctrl_lock, flags); 6719693c drivers/tty/tty_io.c 408) 2812d9e9 drivers/tty/tty_io.c 409) if (tty_pgrp && pgrp != tty->pgrp) { The disassembly would really help. Feel free to send it to me off-list. Regards, Peter Hurley >>> Disabling lock debugging due to kernel taint >>> INFO: Allocated in tty_ldisc_get.part.3+0x66/0x140 age=6 cpu=3 pid=6230 >>> [< none >] kmem_cache_alloc_trace+0x1cf/0x220 mm/slub.c:2589 >>> [< none >] tty_ldisc_get.part.3+0x66/0x140 drivers/tty/tty_ldisc.c:172 >>> [< none >] tty_set_ldisc+0x83d/0xa70 drivers/tty/tty_ldisc.c:574 >>> [< none >] tty_ioctl+0xb2a/0x2140 drivers/tty/tty_io.c:2865 >>> [< inline >] spin_unlock include/linux/spinlock.h:347 >>> [< inline >] ioctl_fionbio fs/ioctl.c:492 >>> [< none >] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:572 >>> [< none >] SyS_ioctl+0x8f/0xc0 fs/readdir.c:25 >>> [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a >>> arch/x86/entry/entry_64.S:185 >>> >>> INFO: Freed in tty_set_ldisc+0x4c2/0xa70 age=12 cpu=3 pid=6230 >>> [< none >] kfree+0x199/0x1b0 mm/slub.c:3632 >>> [< inline >] tty_ldisc_restore drivers/tty/tty_ldisc.c:493 >>> [< none >] tty_set_ldisc+0x4c2/0xa70 drivers/tty/tty_ldisc.c:571 >>> [< none >] tty_ioctl+0xb2a/0x2140 drivers/tty/tty_io.c:2865 >>> [< inline >] spin_unlock include/linux/spinlock.h:347 >>> [< inline >] ioctl_fionbio fs/ioctl.c:492 >>> [< none >] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:572 >>> [< none >] SyS_ioctl+0x8f/0xc0 fs/readdir.c:25 >>> [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a >>> arch/x86/entry/entry_64.S:185 >>> >>> INFO: Slab 0xffffea000186a800 objects=23 used=19 fp=0xffff880061aa12d0 >>> flags=0x5fffc0000004080 >>> INFO: Object 0xffff880061aa0968 @offset=2408 fp=0xffff880061aa0810 >>> CPU: 2 PID: 6241 Comm: a.out Tainted: G B 4.4.0-rc1+ #117 >>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >>> 00000000ffffffff ffff88006db0fab8 ffffffff827450f6 ffff88003e807980 >>> ffff880061aa0968 ffff880061aa0000 ffff88006db0fae8 ffffffff81629404 >>> ffff88003e807980 ffffea000186a800 ffff880061aa0968 000000000000001b >>> >>> Call Trace: >>> [] __asan_report_load8_noabort+0x3e/0x40 >>> mm/kasan/report.c:280 >>> [< inline >] tty_check_change drivers/tty/tty_io.c:399 >>> [] tty_ioctl+0x1f06/0x2140 drivers/tty/tty_io.c:2831 >>> [< inline >] spin_unlock include/linux/spinlock.h:347 >>> [< inline >] ioctl_fionbio fs/ioctl.c:492 >>> [] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:572 >>> [] SyS_ioctl+0x8f/0xc0 fs/readdir.c:25 >>> [] entry_SYSCALL_64_fastpath+0x16/0x7a >>> arch/x86/entry/entry_64.S:185 >>> ================================================================== >>> >>> >>> On commit 6ffeba9607343f15303a399bc402a538800d89d9 (Nov 24). >> >> -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/