net/xfrm: stack out-of-bounds in xfrm_flowi_sport

From: Dmitry Vyukov
Date: Mon Feb 13 2017 - 09:47:25 EST


Hello,

The following program triggers stack out-of-bounds in xfrm_flowi_sport:


BUG: KASAN: stack-out-of-bounds in xfrm_flowi_sport
include/net/xfrm.h:862 [inline] at addr ffff8800677df796
BUG: KASAN: stack-out-of-bounds in __xfrm6_selector_match
net/xfrm/xfrm_policy.c:89 [inline] at addr ffff8800677df796
BUG: KASAN: stack-out-of-bounds in xfrm_selector_match+0xc94/0xe40
net/xfrm/xfrm_policy.c:101 at addr ffff8800677df796
Read of size 2 by task a.out/3338
page:ffffea00016a38c8 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x100000000000000()
raw: 0100000000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 dead000000000200 0000000000000000
page dumped because: kasan: bad access detected
CPU: 0 PID: 3338 Comm: a.out Tainted: G B 4.10.0-rc8+ #218
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__asan_report_load2_noabort+0x29/0x30 mm/kasan/report.c:329
xfrm_flowi_sport include/net/xfrm.h:862 [inline]
__xfrm6_selector_match net/xfrm/xfrm_policy.c:89 [inline]
xfrm_selector_match+0xc94/0xe40 net/xfrm/xfrm_policy.c:101
xfrm_sk_policy_lookup+0x1bb/0x540 net/xfrm/xfrm_policy.c:1259
xfrm_lookup+0x215/0x10f0 net/xfrm/xfrm_policy.c:2256
xfrm_lookup_route+0x39/0x1a0 net/xfrm/xfrm_policy.c:2390
ip_route_output_flow+0x7f/0xa0 net/ipv4/route.c:2447
udp_sendmsg+0x162b/0x2b80 net/ipv4/udp.c:1027
udpv6_sendmsg+0x10a9/0x3170 net/ipv6/udp.c:1065
inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
sock_sendmsg_nosec net/socket.c:635 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:645
SYSC_sendto+0x660/0x810 net/socket.c:1687
SyS_sendto+0x40/0x50 net/socket.c:1655
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x436ed3
RSP: 002b:00007fff6d081748 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000401860 RCX: 0000000000436ed3
RDX: 000000000000008f RSI: 0000000020003f71 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000020003000 R09: 0000000000000010
R10: 0000000000040084 R11: 0000000000000246 R12: 00000000004002b0
R13: 0000000000401860 R14: 00000000004018f0 R15: 0000000000000000
Memory state around the buggy address:
ffff8800677df680: f1 00 f2 f2 f2 f2 f2 f2 f2 f8 f2 f2 f2 f2 f2 f2
ffff8800677df700: f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00
>ffff8800677df780: f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 f2 f2
^
ffff8800677df800: f2 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00
ffff8800677df880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================


// autogenerated by syzkaller (http://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <sys/mman.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <linux/in.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main()
{
mmap((void*)0x20000000ul, 0xfff000ul, 0x3ul, 0x32ul, -1, 0);
int sock = socket(AF_INET6, SOCK_DGRAM, IPPROTO_IP);
(*(uint64_t*)0x20000098 = (uint64_t)0x20b50000);
(*(uint32_t*)0x200000a0 = (uint32_t)0x1);
(*(uint64_t*)0x20000000 = (uint64_t)0x20005000);
(*(uint64_t*)0x20000008 = (uint64_t)0x20002fdc);
(*(uint64_t*)0x20000010 = (uint64_t)0x20001ff8);
(*(uint64_t*)0x20000018 = (uint64_t)0x20004ff0);
(*(uint32_t*)0x20000020 = (uint32_t)0x1);
(*(uint32_t*)0x20000024 = (uint32_t)0x0);
(*(uint32_t*)0x20000028 = (uint32_t)0x2);
(*(uint32_t*)0x2000002c = (uint32_t)0x0);
(*(uint32_t*)0x20000030 = (uint32_t)0x0);
(*(uint32_t*)0x20000034 = (uint32_t)0x0);
(*(uint32_t*)0x20000038 = (uint32_t)0x0);
(*(uint32_t*)0x2000003c = (uint32_t)0x0);
setsockopt(sock, 0x29ul, 0x23ul, (void*)0x20000000ul, 0x264ul);
(*(uint16_t*)0x20003000 = (uint16_t)0x2);
(*(uint16_t*)0x20003002 = (uint16_t)0x214e);
(*(uint32_t*)0x20003004 = (uint32_t)0x0);
(*(uint8_t*)0x20003008 = (uint8_t)0x0);
(*(uint8_t*)0x20003009 = (uint8_t)0x0);
(*(uint8_t*)0x2000300a = (uint8_t)0x0);
(*(uint8_t*)0x2000300b = (uint8_t)0x0);
(*(uint8_t*)0x2000300c = (uint8_t)0x0);
(*(uint8_t*)0x2000300d = (uint8_t)0x0);
(*(uint8_t*)0x2000300e = (uint8_t)0x0);
(*(uint8_t*)0x2000300f = (uint8_t)0x0);
sendto(sock, (void*)0x20003f71ul, 0x8ful, 0x40084ul,
(void*)0x20003000ul, 0x10ul);
return 0;
}


On commit 7089db84e356562f8ba737c29e472cc42d530dbc.


struct flowi4 fl4_stack allocated on stack in udp_sendmsg is being
casted to larger struct flowi and then accessed.