Skip to contentSkip to conversation

net, ipv6: out of bounds access in secret_stable

DISCUSSION Sasha Levin 3 participants 4 messages Dec 19, 2015 – Dec 21, 2015

Subsystems (3)
Networking Network drivers IPv4/IPv6
lore
Share & tools
lore

Sasha Levin

author
#0 lore raw

Hi Hannes,

I've hit the following out of bounds access while fuzzing on the latest -next kernel.

This code was added in 3d1bec9932 ("ipv6: introduce secret_stable to ipv6_devconf").

[  459.553655] BUG: KASAN: stack-out-of-bounds in strlen+0x58/0x90 at addr ffff8802ab0efb0e
[  459.554953] Read of size 1 by task trinity-c91/22576
[  459.555805] page:ffffea000aac3bc0 count:0 mapcount:0 mapping:          (null) index:0x0
[  459.556899] flags: 0x26fffff80000000()
[  459.557521] page dumped because: kasan: bad access detected
[  459.558320] CPU: 7 PID: 22576 Comm: trinity-c91 Not tainted 4.4.0-rc5-next-20151218-sasha-00021-gaba8d84-dirty #2750
[  459.559809]  0000000000000000 00000000549d0aa3 ffff8802ab0ef860 ffffffffa1042384
[  459.561036]  0000000041b58ab3 ffffffffac667cdb ffffffffa10422d9 ffff8802ab0ef848
[  459.562245]  ffffffff9f6a417e 00000000549d0aa3 ffff8802ab0efb0e ffff8802ab0efb0e
[  459.563429] Call Trace:
[  459.563831] dump_stack (lib/dump_stack.c:52)
[  459.564623] ? _atomic_dec_and_lock (lib/dump_stack.c:27)
[  459.565628] ? __dump_page (mm/debug.c:126)
[  459.566538] kasan_report_error (include/linux/kasan.h:28 mm/kasan/report.c:170 mm/kasan/report.c:237)
[  459.570997] __asan_report_load1_noabort (mm/kasan/report.c:277)
[  459.572119] ? check_preemption_disabled (lib/smp_processor_id.c:39)
[  459.573731] ? strlen (lib/string.c:481 (discriminator 1))
[  459.574646] strlen (lib/string.c:481 (discriminator 1))
[  459.575485] proc_dostring (kernel/sysctl.c:1825 kernel/sysctl.c:1906)
[  459.576445] ? alloc_debug_processing (mm/slub.c:1054)
[  459.577523] addrconf_sysctl_stable_secret (net/ipv6/addrconf.c:5395)
[  459.583431] proc_sys_call_handler (fs/proc/proc_sysctl.c:543)
[  459.587326] proc_sys_write (fs/proc/proc_sysctl.c:562)
[  459.588378] do_loop_readv_writev (fs/read_write.c:725)
[  459.589374] do_readv_writev (fs/read_write.c:853)
[  459.601113] vfs_writev (fs/read_write.c:891)
[  459.601895] ? __fdget_pos (fs/file.c:781)
[  459.602918] SyS_writev (fs/read_write.c:924 fs/read_write.c:915)
[  459.604122] ? SyS_readv (fs/read_write.c:915)
[  459.605163] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)
[  459.606131] Memory state around the buggy address:
[  459.607020]  ffff8802ab0efa00: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00
[  459.608442]  ffff8802ab0efa80: f2 f2 f2 f2 00 00 f4 f4 f2 f2 f2 f2 00 00 00 00
[  459.610252] >ffff8802ab0efb00: 00 06 f4 f4 f3 f3 f3 f3 00 00 00 00 00 00 00 00
[  459.612306]                       ^
[  459.613233]  ffff8802ab0efb80: 00 00 f1 f1 f1 f1 00 f4 f4 f4 f3 f3 f3 f3 00 00
[  459.615076]  ffff8802ab0efc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Thanks,
Sasha

#1 lore raw
Quoted 19 lines · Sasha Levin

Hi Hannes,

I've hit the following out of bounds access while fuzzing on the latest -next kernel.

This code was added in 3d1bec9932 ("ipv6: introduce secret_stable to ipv6_devconf").

[  459.553655] BUG: KASAN: stack-out-of-bounds in strlen+0x58/0x90 at addr ffff8802ab0efb0e
[  459.554953] Read of size 1 by task trinity-c91/22576
[  459.555805] page:ffffea000aac3bc0 count:0 mapcount:0 mapping:          (null) index:0x0
[  459.556899] flags: 0x26fffff80000000()
[  459.557521] page dumped because: kasan: bad access detected
[  459.558320] CPU: 7 PID: 22576 Comm: trinity-c91 Not tainted 4.4.0-rc5-next-20151218-sasha-00021-gaba8d84-dirty #2750
[  459.559809]  0000000000000000 00000000549d0aa3 ffff8802ab0ef860 ffffffffa1042384
[  459.561036]  0000000041b58ab3 ffffffffac667cdb ffffffffa10422d9 ffff8802ab0ef848
[  459.562245]  ffffffff9f6a417e 00000000549d0aa3 ffff8802ab0efb0e ffff8802ab0efb0e
[  459.563429] Call Trace:
[  459.563831] dump_stack (lib/dump_stack.c:52)
[  459.564623] ? _atomic_dec_and_lock (lib/dump_stack.c:27)
[  459.565628] ? __dump_page (mm/debug.c:126)
Quoted 8 lines
[  459.566538] kasan_report_error (include/linux/kasan.h:28 mm/kasan/report.c:170 mm/kasan/report.c:237)
[  459.570997] __asan_report_load1_noabort (mm/kasan/report.c:277)
[  459.572119] ? check_preemption_disabled (lib/smp_processor_id.c:39)
[  459.573731] ? strlen (lib/string.c:481 (discriminator 1))
[  459.574646] strlen (lib/string.c:481 (discriminator 1))
[  459.575485] proc_dostring (kernel/sysctl.c:1825 kernel/sysctl.c:1906)
[  459.576445] ? alloc_debug_processing (mm/slub.c:1054)
[  459.577523] addrconf_sysctl_stable_secret (net/ipv6/addrconf.c:5395)

Looks like we don't initialize the array on stack for write case. At least other callers always initialize the data for both read and write.

Please try the attached patch.

Thanks!

net/ipv6/addrconf.c +5 -7
index 17f8e7e..8d4fa7c 100644
@@ -5369,13 +5369,11 @@ static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write,
 		goto out;
 	}
 
-	if (!write) {
-		err = snprintf(str, sizeof(str), "%pI6",
-			       &secret->secret);
-		if (err >= sizeof(str)) {
-			err = -EIO;
-			goto out;
-		}
+	err = snprintf(str, sizeof(str), "%pI6",
+		       &secret->secret);
+	if (err >= sizeof(str)) {
+		err = -EIO;
+		goto out;
 	}
 
 	err = proc_dostring(&lctl, write, buffer, lenp, ppos);
Acked-by
#2 lore raw
Quoted 29 lines · Cong Wang
Quoted 19 lines · Sasha Levin

Hi Hannes,

I've hit the following out of bounds access while fuzzing on the latest -next kernel.

This code was added in 3d1bec9932 ("ipv6: introduce secret_stable to ipv6_devconf").

[  459.553655] BUG: KASAN: stack-out-of-bounds in strlen+0x58/0x90 at addr ffff8802ab0efb0e
[  459.554953] Read of size 1 by task trinity-c91/22576
[  459.555805] page:ffffea000aac3bc0 count:0 mapcount:0 mapping:          (null) index:0x0
[  459.556899] flags: 0x26fffff80000000()
[  459.557521] page dumped because: kasan: bad access detected
[  459.558320] CPU: 7 PID: 22576 Comm: trinity-c91 Not tainted 4.4.0-rc5-next-20151218-sasha-00021-gaba8d84-dirty #2750
[  459.559809]  0000000000000000 00000000549d0aa3 ffff8802ab0ef860 ffffffffa1042384
[  459.561036]  0000000041b58ab3 ffffffffac667cdb ffffffffa10422d9 ffff8802ab0ef848
[  459.562245]  ffffffff9f6a417e 00000000549d0aa3 ffff8802ab0efb0e ffff8802ab0efb0e
[  459.563429] Call Trace:
[  459.563831] dump_stack (lib/dump_stack.c:52)
[  459.564623] ? _atomic_dec_and_lock (lib/dump_stack.c:27)
[  459.565628] ? __dump_page (mm/debug.c:126)
Quoted 8 lines
[  459.566538] kasan_report_error (include/linux/kasan.h:28 mm/kasan/report.c:170 mm/kasan/report.c:237)
[  459.570997] __asan_report_load1_noabort (mm/kasan/report.c:277)
[  459.572119] ? check_preemption_disabled (lib/smp_processor_id.c:39)
[  459.573731] ? strlen (lib/string.c:481 (discriminator 1))
[  459.574646] strlen (lib/string.c:481 (discriminator 1))
[  459.575485] proc_dostring (kernel/sysctl.c:1825 kernel/sysctl.c:1906)
[  459.576445] ? alloc_debug_processing (mm/slub.c:1054)
[  459.577523] addrconf_sysctl_stable_secret (net/ipv6/addrconf.c:5395)
Quoted 5 lines

Looks like we don't initialize the array on stack for write case. At least other callers always initialize the data for both read and write.

Please try the attached patch.

Your patch is right. I am surprised you need to initialize the buffer passed down to proc_dostring so that strlen can correctly operate on it, but f4aacea2f5d1a5 ("sysctl: allow for strict write position handling") explains why. Can you submit formally?

Acked-by Hannes Frederic Sowa <[email protected]>

Thanks,
Hannes

author
#3 lore raw
Quoted 34 lines · Hannes Frederic Sowa
Quoted 33 lines · Cong Wang
Quoted 19 lines · Sasha Levin

Hi Hannes,

I've hit the following out of bounds access while fuzzing on the latest -next kernel.

This code was added in 3d1bec9932 ("ipv6: introduce secret_stable to ipv6_devconf").

[  459.553655] BUG: KASAN: stack-out-of-bounds in strlen+0x58/0x90 at addr ffff8802ab0efb0e
[  459.554953] Read of size 1 by task trinity-c91/22576
[  459.555805] page:ffffea000aac3bc0 count:0 mapcount:0 mapping:          (null) index:0x0
[  459.556899] flags: 0x26fffff80000000()
[  459.557521] page dumped because: kasan: bad access detected
[  459.558320] CPU: 7 PID: 22576 Comm: trinity-c91 Not tainted 4.4.0-rc5-next-20151218-sasha-00021-gaba8d84-dirty #2750
[  459.559809]  0000000000000000 00000000549d0aa3 ffff8802ab0ef860 ffffffffa1042384
[  459.561036]  0000000041b58ab3 ffffffffac667cdb ffffffffa10422d9 ffff8802ab0ef848
[  459.562245]  ffffffff9f6a417e 00000000549d0aa3 ffff8802ab0efb0e ffff8802ab0efb0e
[  459.563429] Call Trace:
[  459.563831] dump_stack (lib/dump_stack.c:52)
[  459.564623] ? _atomic_dec_and_lock (lib/dump_stack.c:27)
[  459.565628] ? __dump_page (mm/debug.c:126)
Quoted 8 lines
[  459.566538] kasan_report_error (include/linux/kasan.h:28 mm/kasan/report.c:170 mm/kasan/report.c:237)
[  459.570997] __asan_report_load1_noabort (mm/kasan/report.c:277)
[  459.572119] ? check_preemption_disabled (lib/smp_processor_id.c:39)
[  459.573731] ? strlen (lib/string.c:481 (discriminator 1))
[  459.574646] strlen (lib/string.c:481 (discriminator 1))
[  459.575485] proc_dostring (kernel/sysctl.c:1825 kernel/sysctl.c:1906)
[  459.576445] ? alloc_debug_processing (mm/slub.c:1054)
[  459.577523] addrconf_sysctl_stable_secret (net/ipv6/addrconf.c:5395)

Looks like we don't initialize the array on stack for write case. At least other callers always initialize the data for both read and write.

Quoted 8 lines
Quoted 1 line

Please try the attached patch.

Your patch is right. I am surprised you need to initialize the buffer passed down to proc_dostring so that strlen can correctly operate on it, but f4aacea2f5d1a5 ("sysctl: allow for strict write position handling") explains why. Can you submit formally?

Acked-by Hannes Frederic Sowa <[email protected]>

And that seems to fix the issue here as well.

Thanks,
Sasha