Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S966446AbbLPTfN (ORCPT <rfc822;w@1wt.eu>);
	Wed, 16 Dec 2015 14:35:13 -0500
Received: from mail-wm0-f51.google.com ([74.125.82.51]:32868 "EHLO
	mail-wm0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751101AbbLPTfK (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Wed, 16 Dec 2015 14:35:10 -0500
MIME-Version: 1.0
From: Dmitry Vyukov <dvyukov@google.com>
Date: Wed, 16 Dec 2015 20:34:49 +0100
Message-ID: <CACT4Y+Y5jtsfn4U8C-iBT4njrjXH+fFmvajuyhA-VpEchjLKFw@mail.gmail.com>
Subject: net: heap-out-of-bounds in sock_setsockopt
To: Willem de Bruijn <willemb@google.com>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        Mel Gorman <mgorman@techsingularity.net>,
        Craig Gallek <kraig@google.com>, Ying Xue <ying.xue@windriver.com>,
        Hannes Frederic Sowa <hannes@stressinduktion.org>,
        Edward Jee <edjee@google.com>, Julia Lawall <julia.lawall@lip6.fr>,
        netdev <netdev@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>
Cc: syzkaller <syzkaller@googlegroups.com>, Kostya Serebryany <kcc@google.com>,
        Alexander Potapenko <glider@google.com>,
        Sasha Levin <sasha.levin@oracle.com>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 2443
Lines: 63

Hello,

The following program triggers heap-out-of-bounds access in sock_setsockopt:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <syscall.h>
#include <string.h>
#include <stdint.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/in.h>
#include <linux/in6.h>

#define SOF_TIMESTAMPING_OPT_ID (1<<7)

int main()
{
        int fd = socket(PF_INET6, SOCK_RAW, IPPROTO_TCP);
        struct sockaddr_in6 sa = {};
        sa.sin6_family = AF_INET6;
        sa.sin6_port = htons(13277);
        inet_pton(AF_INET6, "::1", &sa.sin6_addr);
        connect(fd, (struct sockaddr*)&sa, sizeof(sa));
        int opt = SOF_TIMESTAMPING_OPT_ID;
        setsockopt(fd, SOL_SOCKET, SO_TIMESTAMPING, &opt, sizeof(opt));
        return 0;
}


BUG: KASAN: slab-out-of-bounds in sock_setsockopt+0x1284/0x13d0 at
addr ffff88006563ec10
Read of size 4 by task syzkaller_execu/4755
=============================================================================
BUG RAWv6 (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in sk_prot_alloc+0x69/0x340 age=17 cpu=3 pid=4755
[<      none      >] kmem_cache_alloc+0x244/0x2c0 mm/slub.c:2607
[<      none      >] sk_prot_alloc+0x69/0x340 net/core/sock.c:1343
[<      none      >] sk_alloc+0x3a/0x6b0 net/core/sock.c:1418
[<      none      >] inet6_create+0x2c4/0xfd0 net/ipv6/af_inet6.c:170
[<      none      >] __sock_create+0x37c/0x640 net/socket.c:1162
[<     inline     >] sock_create net/socket.c:1202
[<     inline     >] SYSC_socket net/socket.c:1232
[<      none      >] SyS_socket+0xef/0x1b0 net/socket.c:1212
[<      none      >] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185

Call Trace:
 [<ffffffff816cec2e>] __asan_report_load4_noabort+0x3e/0x40
mm/kasan/report.c:294
 [<ffffffff84affb14>] sock_setsockopt+0x1284/0x13d0 net/core/sock.c:880
 [<     inline     >] SYSC_setsockopt net/socket.c:1746
 [<ffffffff84aed7ee>] SyS_setsockopt+0x1fe/0x240 net/socket.c:1729
 [<ffffffff85c18c76>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185


On commit edb42dc7bc0da0125ceacab810a553ce1f0cac8d (Dec 15).
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/