Re: net/tcp: null-ptr-deref in __inet_lookup_listener/inet_exact_dif_match

2016-11-02 Thread Andrey Konovalov 
Hi David,

I'm able to reproduce it, so I'd be happy to test your fix.

Thanks!

On Wed, Nov 2, 2016 at 7:31 PM, David Ahern  wrote:
> On 11/2/16 11:21 AM, Eric Dumazet wrote:
>> Thanks for your report.
>>
>> David, please take a look.
>>
>> TCP MD5 can call __inet_lookup_listener() with a NULL skb.
>
> interesting. I did not test md5 before sending, but doing so now I am not 
> able to trigger the panic with any combination of passwords - correct, wrong, 
> none, no listener, etc. perhaps I am missing a sysctl setting.
>
> Will send a fix. I see the call to __inet_lookup_listener with null skb.
>
>>
>> Bug added in commit a04a480d4392ea6efd117be2de564117b2a009c0
>

Re: net/tcp: null-ptr-deref in __inet_lookup_listener/inet_exact_dif_match

2016-11-02 Thread Eric Dumazet 
On Wed, 2016-11-02 at 18:01 +0100, Andrey Konovalov wrote:
> Hi,
> 
> I've got the following error report while running the syzkaller fuzzer:
> 
> general protection fault:  [#1] SMP KASAN
> Dumping ftrace buffer:
>(ftrace buffer empty)
> Modules linked in:
> CPU: 0 PID: 648 Comm: syz-executor Not tainted 4.9.0-rc3+ #333
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> task: 8800398c4480 task.stack: 88003b468000
> RIP: 0010:[]  [< inline >]
> inet_exact_dif_match include/net/tcp.h:808
> RIP: 0010:[]  []
> __inet_lookup_listener+0xb6/0x500 net/ipv4/inet_hashtables.c:219
> RSP: 0018:88003b46f270  EFLAGS: 00010202
> RAX: 0004 RBX: 4242 RCX: 0001
> RDX:  RSI: c9e3c000 RDI: 0054
> RBP: 88003b46f2d8 R08: 4000 R09: 830910e7
> R10:  R11: 000a R12: 867fa0c0
> R13: 4242 R14: 0003 R15: dc00
> FS:  7fb135881700() GS:88003ec0() knlGS:
> CS:  0010 DS:  ES:  CR0: 80050033
> CR2: 20cc3000 CR3: 6d56a000 CR4: 06f0
> Stack:
>   0601a8c0  4242
>  42423b9083c2 88003def4041 84e7e040 0246
>  88003a0911c0  88003a091298 88003b9083ae
> Call Trace:
>  [] tcp_v4_send_reset+0x584/0x1700 net/ipv4/tcp_ipv4.c:643
>  [] tcp_v4_rcv+0x198b/0x2e50 net/ipv4/tcp_ipv4.c:1718
>  [] ip_local_deliver_finish+0x332/0xad0
> net/ipv4/ip_input.c:216
>  [< inline >] NF_HOOK_THRESH include/linux/netfilter.h:232
>  [< inline >] NF_HOOK include/linux/netfilter.h:255
>  [] ip_local_deliver+0x1c2/0x4b0 net/ipv4/ip_input.c:257
>  [< inline >] dst_input include/net/dst.h:507
>  [] ip_rcv_finish+0x750/0x1c40 net/ipv4/ip_input.c:396
>  [< inline >] NF_HOOK_THRESH include/linux/netfilter.h:232
>  [< inline >] NF_HOOK include/linux/netfilter.h:255
>  [] ip_rcv+0x96f/0x12f0 net/ipv4/ip_input.c:487
>  [] __netif_receive_skb_core+0x1897/0x2a50 
> net/core/dev.c:4213
>  [] __netif_receive_skb+0x2a/0x170 net/core/dev.c:4251
>  [] netif_receive_skb_internal+0x1b3/0x390 
> net/core/dev.c:4279
>  [] netif_receive_skb+0x48/0x250 net/core/dev.c:4303
>  [] tun_get_user+0xbd5/0x28a0 drivers/net/tun.c:1308
>  [] tun_chr_write_iter+0xda/0x190 drivers/net/tun.c:1332
>  [< inline >] new_sync_write fs/read_write.c:499
>  [] __vfs_write+0x334/0x570 fs/read_write.c:512
>  [] vfs_write+0x17b/0x500 fs/read_write.c:560
>  [< inline >] SYSC_write fs/read_write.c:607
>  [] SyS_write+0xd4/0x1a0 fs/read_write.c:599
>  [] entry_SYSCALL_64_fastpath+0x1f/0xc2
> Code: 00 00 45 85 c9 75 46 e8 e9 65 29 fe 4c 8b 55 a8 49 bf 00 00 00
> 00 00 fc ff df 49 8d 7a 54 49 89 fb 48 89 f8 49 c1 eb 03 83 e0 07 <43>
> 0f b6 1c 3b 83 c0 01 38 d8 7c 08 84 db 0f 85 a9 03 00 00 48
> RIP  [< inline >] inet_exact_dif_match include/net/tcp.h:808
> RIP  [] __inet_lookup_listener+0xb6/0x500
> net/ipv4/inet_hashtables.c:219
>  RSP 
> ---[ end trace 351d030d30a11e1a ]---
> Kernel panic - not syncing: Fatal exception in interrupt
> Dumping ftrace buffer:
>(ftrace buffer empty)
> Kernel Offset: disabled
> 
> On commit 0c183d92b20b5c84ca655b45ef57b3318b83eb9e (Oct 31).
> 
> Thanks!

Thanks for your report.

David, please take a look.

TCP MD5 can call __inet_lookup_listener() with a NULL skb.

Bug added in commit a04a480d4392ea6efd117be2de564117b2a009c0

net/tcp: null-ptr-deref in __inet_lookup_listener/inet_exact_dif_match

2016-11-02 Thread Andrey Konovalov 
Hi,

I've got the following error report while running the syzkaller fuzzer:

general protection fault:  [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 648 Comm: syz-executor Not tainted 4.9.0-rc3+ #333
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: 8800398c4480 task.stack: 88003b468000
RIP: 0010:[]  [< inline >]
inet_exact_dif_match include/net/tcp.h:808
RIP: 0010:[]  []
__inet_lookup_listener+0xb6/0x500 net/ipv4/inet_hashtables.c:219
RSP: 0018:88003b46f270  EFLAGS: 00010202
RAX: 0004 RBX: 4242 RCX: 0001
RDX:  RSI: c9e3c000 RDI: 0054
RBP: 88003b46f2d8 R08: 4000 R09: 830910e7
R10:  R11: 000a R12: 867fa0c0
R13: 4242 R14: 0003 R15: dc00
FS:  7fb135881700() GS:88003ec0() knlGS:
CS:  0010 DS:  ES:  CR0: 80050033
CR2: 20cc3000 CR3: 6d56a000 CR4: 06f0
Stack:
  0601a8c0  4242
 42423b9083c2 88003def4041 84e7e040 0246
 88003a0911c0  88003a091298 88003b9083ae
Call Trace:
 [] tcp_v4_send_reset+0x584/0x1700 net/ipv4/tcp_ipv4.c:643
 [] tcp_v4_rcv+0x198b/0x2e50 net/ipv4/tcp_ipv4.c:1718
 [] ip_local_deliver_finish+0x332/0xad0
net/ipv4/ip_input.c:216
 [< inline >] NF_HOOK_THRESH include/linux/netfilter.h:232
 [< inline >] NF_HOOK include/linux/netfilter.h:255
 [] ip_local_deliver+0x1c2/0x4b0 net/ipv4/ip_input.c:257
 [< inline >] dst_input include/net/dst.h:507
 [] ip_rcv_finish+0x750/0x1c40 net/ipv4/ip_input.c:396
 [< inline >] NF_HOOK_THRESH include/linux/netfilter.h:232
 [< inline >] NF_HOOK include/linux/netfilter.h:255
 [] ip_rcv+0x96f/0x12f0 net/ipv4/ip_input.c:487
 [] __netif_receive_skb_core+0x1897/0x2a50 net/core/dev.c:4213
 [] __netif_receive_skb+0x2a/0x170 net/core/dev.c:4251
 [] netif_receive_skb_internal+0x1b3/0x390 net/core/dev.c:4279
 [] netif_receive_skb+0x48/0x250 net/core/dev.c:4303
 [] tun_get_user+0xbd5/0x28a0 drivers/net/tun.c:1308
 [] tun_chr_write_iter+0xda/0x190 drivers/net/tun.c:1332
 [< inline >] new_sync_write fs/read_write.c:499
 [] __vfs_write+0x334/0x570 fs/read_write.c:512
 [] vfs_write+0x17b/0x500 fs/read_write.c:560
 [< inline >] SYSC_write fs/read_write.c:607
 [] SyS_write+0xd4/0x1a0 fs/read_write.c:599
 [] entry_SYSCALL_64_fastpath+0x1f/0xc2
Code: 00 00 45 85 c9 75 46 e8 e9 65 29 fe 4c 8b 55 a8 49 bf 00 00 00
00 00 fc ff df 49 8d 7a 54 49 89 fb 48 89 f8 49 c1 eb 03 83 e0 07 <43>
0f b6 1c 3b 83 c0 01 38 d8 7c 08 84 db 0f 85 a9 03 00 00 48
RIP  [< inline >] inet_exact_dif_match include/net/tcp.h:808
RIP  [] __inet_lookup_listener+0xb6/0x500
net/ipv4/inet_hashtables.c:219
 RSP 
---[ end trace 351d030d30a11e1a ]---
Kernel panic - not syncing: Fatal exception in interrupt
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled

On commit 0c183d92b20b5c84ca655b45ef57b3318b83eb9e (Oct 31).

Thanks!