From mboxrd@z Thu Jan 1 00:00:00 1970 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752215AbeADSO7 (ORCPT + 1 other); Thu, 4 Jan 2018 13:14:59 -0500 Received: from mail-eopbgr40124.outbound.protection.outlook.com ([40.107.4.124]:17846 "EHLO EUR03-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750959AbeADSO5 (ORCPT ); Thu, 4 Jan 2018 13:14:57 -0500 Date: Thu, 4 Jan 2018 10:14:38 -0800 From: Andrei Vagin To: Dmitry Vyukov Cc: syzbot , Jason@zx2c4.com, Andrew Morton , alexander.deucher@amd.com, avagin , Chris Wilson , David Miller , David Ahern , Eric Dumazet , elena.reshetova@intel.com, Greg Kroah-Hartman , Herbert Xu , Johannes Berg , LKML , Xin Long , mchehab@kernel.org, netdev , syzkaller-bugs@googlegroups.com Subject: Re: general protection fault in __netlink_ns_capable Message-ID: <20180104181437.GA6260@outlook.office365.com> References: <001a113f90208881610561cfadcf@google.com> <20180103003508.GA16712@outlook.office365.com> <20180103073703.GA30495@outlook.office365.com> MIME-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.1 (2017-09-22) X-Originating-IP: [4.16.175.162] X-ClientProxiedBy: CY4PR0601CA0034.namprd06.prod.outlook.com (2603:10b6:910:87::47) To VI1PR08MB0750.eurprd08.prod.outlook.com (2a01:111:e400:5a04::12) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 2977b64a-fd2e-4fb7-d843-08d5539f0cf8 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(5600026)(4604075)(2017052603307)(7153060);SRVR:VI1PR08MB0750; X-Microsoft-Exchange-Diagnostics: 1;VI1PR08MB0750;3:O8cFFq/iIPVABUfa8Sl2xazh5DtsCo4IOE9zWGn4X8e9W9zn5cDSmslqJd2iy1khOred350H3L7LwQLJ/S601VqCm0Ijxdmf2nGIBiqXk87X+cOBkb0Y3m2is/0/o9DBx0Ja/QX8dcBnEqIE9pl8gCZYX987ZzUirH4HuXPpMNd9mzBFyPtt+9ZNgVTIJWdxPVDTvBEinIGHQkYcoefdTkVRYn37rZTuBhYLZ+jvcQQdnt2V0rDEw3Z966QdB7NF;25:wFxZV70+2TJ1GIH8/nQ84YOA+6wowvJsp9uJX7fvdatlNwYO2kPw1C5sQSuDZVPlVoryOakrp1Meq5n+gcRp4YcL1YfVx3BvjNkz9EmFf7F1FFbY+BfeG+f/+ome03PIjQGiJXx32hLiRrflq4a5nnqcu7sf8nbCA2vOO+cUgAqUiq2mm6iOmdSjA8ZnfMLoQRl/GnKwLz2XLmvTxCM+/zzUPTH/YIlvuaDoDJBS12D8hlOkh14q98xf5sVJqLrbmVsu02nHCOrcopylrA1Qxr5qd0QzuawzAaMqj9vRNKgYYHfYlm4hU7uH24iuXZxsBjhQ3YwpUnm0jYE+6LxBxA==;31:uFfV8q/NXA4Pcs7v5JUD02Ukvqpg7bblDM0oeLwz4n988JgAx2x2C0CChwh9NND1OpqookeBHdcVLB/Ngrzjc/O3VJ4OFrtAGy8N9h5Y9pbbUqeWJK+oZJOnVppH7XDu54yW4zyvxDS8SyTlaw2YH4oc6hZrwSG+FMx1wQ/FuoUvqmEsMMgDy1MXsZnQjIy/i0OgHo+m5hfoKS0Vy1tMT7LW95jIwYctbE+dgr0uGec= X-MS-TrafficTypeDiagnostic: VI1PR08MB0750: X-Microsoft-Exchange-Diagnostics: 1;VI1PR08MB0750;20:cxjUXwYrAmVhQfCyWEVfMlb8+9lx/kEXOgok074ULe72xNNlajGoSPPrm/oee1iIKHyOs1EyXYd9MmNVi/tdyv/NXu2voh2yIKgQ49qgaeCdir8M9xfrcU+S947Ot7zPR8CdHN4dE3nHRjfA/X61v+ZIK91vx+Z9VSr88eTV/JWcKSRlZ4KPYnMzNifyXZ5x4Z8w+OvUFlJgcfnN78MHYrlLNYE01pwrUfk4CZ7KJLtr0t9Pm6RJFytL2s330Cg93qCafC/S77AaH3A0fySfw98hV0wdMTmRwPgd94Xh2AthZlV2g6na25DuN/CI2NX0fap2TqUGima72rfzOA+qg3OpZiq5Evux6W4sVSWJej/8RwOddUn0dIQFfyPVYzDS8s5SwKV5Mp6nkIBSp89ibLRRWHPQqvu9/sQY1IRTY9Q=;4:bMDd0hnyuJct4dBHiZRYq4RCbEotEbwVbKmPtGeTrfOnJjbyr4nolZ3S6+De1Ntxp+UTtRKOUcZupyubbLan4NK0J3aISkIgZtBcV7OSaIcOfPNzdqNKhtLIDg30F6O//cOJZ30f0zKK1pBwPNlrpbEN3SYcnndObxGsoSBrk4NUpK6ls+OqFYmAsWpS2QANWR8a+rGFeJ6WQclqyHVbDVmqoQWrOBAj9GcbNlleZM0KFh6jA7pSIqb5vZKjZ0D6X3wKGmoFyoZgwleoCc5emw== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040470)(2401047)(8121501046)(5005006)(3002001)(3231023)(944501075)(93006095)(93001095)(10201501046)(6041268)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123564045)(20161123562045)(20161123560045)(6072148)(201708071742011);SRVR:VI1PR08MB0750;BCL:0;PCL:0;RULEID:(100000803101)(100110400095);SRVR:VI1PR08MB0750; X-Forefront-PRVS: 054231DC40 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(396003)(346002)(376002)(39380400002)(39840400004)(366004)(199004)(189003)(24454002)(6916009)(8676002)(6666003)(2950100002)(5660300001)(59450400001)(6246003)(2906002)(81166006)(25786009)(7416002)(53416004)(105586002)(106356001)(11609785009)(93886005)(97736004)(23686003)(53936002)(3846002)(6116002)(7736002)(81156014)(4326008)(39060400002)(8936002)(305945005)(76176011)(52116002)(7696005)(1076002)(68736007)(83506002)(6506007)(5890100001)(966005)(66066001)(53546011)(478600001)(54906003)(16586007)(16526018)(47776003)(69596002)(58126008)(45080400002)(86362001)(386003)(9686003)(50466002)(37156001)(229853002)(33656002)(6306002)(55016002)(316002)(8666007)(18370500001);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR08MB0750;H:outlook.office365.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=avagin@virtuozzo.com; X-Microsoft-Exchange-Diagnostics: =?koi8-r?Q?1;VI1PR08MB0750;23:jlrt0IcYc/riI5MBa8qJEw50ulbmSC0CDOYv/tdLSYD?= =?koi8-r?Q?XZ8CzIhjV3fB4aJW3iPpcjvR/OuJZYITWfR2KJY3fJzH1NvmnYpKdlsyL6jbVO?= =?koi8-r?Q?MiWPHpPwg5MWql/SSD1m3j/u/E3xPPRYCKLBySo18FW48xEO5iqmevo9CMFoWg?= =?koi8-r?Q?1r8fl5Xkwxze0nsP9FbPmJH2Rfj8C3rj8iWrh+mR+JQqxLejyxu23zpYxTMV9K?= =?koi8-r?Q?ErB6v9dRLy7dfJqp/Zs7gTv8295hJf+3DvyvUZO8nCrlFS1ISyTkd/2MX0cgz+?= =?koi8-r?Q?WiJZb+msBqgYzv14vmpKNSLzLjZYMIRos4bi7miKXB6QmEilaKMVQEqQqBgTHL?= =?koi8-r?Q?6fKQd1Y+ARNKPo3rwfmv65o/TKRHZbXnxhY771Z4IEUTjtCfujC1qrGK7RHCpx?= =?koi8-r?Q?nyfQdZ2tlJ51su4jYPc/PAeyiSgZBg4quZdXSDJpXVOlmDBVvK9VhRurK+90GK?= =?koi8-r?Q?csPimpttWR7yfiaHwUS0BgeF4ru3ROYWcZD5CaHLf3G35+W0OObcbxVFw2o1Qe?= =?koi8-r?Q?OJ20TZ9Tz4R61th887Hvyt6+jx95svwNdjCekHcEq1Hyh0f2Z9SDmM04fhpoot?= =?koi8-r?Q?Hx/0c7uJWtBP2U2yS1jT27AVb0DGdwueay5pNQ4pT0Nvkt5Gzgn5MxJ6oVQMFK?= =?koi8-r?Q?AtZ8DH76g8nlBejIrv1mBd7aQvM1f3g7XoPgtKF/ZiOgOgQtNIrHSwSJGAAzNv?= =?koi8-r?Q?0sIXq69j+MNZEsQrwd2DpJP8AJC8FJyPGl6UpM11XlXpKKG3owhsY9pNaZkDoC?= =?koi8-r?Q?U+vw2Hxsa2DdEkD5T88kvxz42rM+0IQjA3TuYsseDYiTacsE330I5hNLSGGvFP?= =?koi8-r?Q?KZAo7pWZCW53o4VrgH8i1IcfTM1Ao8GKYFpev396IeMTsoUGkWyx3te9DA2N0t?= =?koi8-r?Q?ltWILeTKomIxzuy0rag0dN+2fJdEL8e35EE6/x1wp5P5uMGKwJsKt/kCb4xSo/?= =?koi8-r?Q?TueJi6r4G9fLe1xqcjDilsro+kN27jHkG07+Y+gQxxc5Ze3C7NFOkayAufALmq?= =?koi8-r?Q?1bSX2Vhu5YXroQjU0/8cUBmmiOcqY50IW/jWOYLGkNKJwsk+b71SqZgstVvU4R?= =?koi8-r?Q?vgaTRwrrLcvaBb2Z1DHFUDyTr2hGocZV+xYu170D9LIwlEIdcPFfG3Wnv02p23?= =?koi8-r?Q?e0Z2ppAGFlMiNgbGweyDQ5FCX76f7sb4q9d4fHHWMH661igMf0GLmOBLBqaIrX?= =?koi8-r?Q?2NQJlDtNjS+Io3Qv6QnzaKPUuy4dVthdRL6aK7diw8zs+cB7d+DmYaP4vuNFiO?= =?koi8-r?Q?Lz6ikxI91vBxCyblqQ+s+2b8A4xLHADroy1RQ5hJpvAdzuFjBtxxHEWlriWSjW?= =?koi8-r?Q?cgLlxnn9+QH88fSd7Imx6a6Ndueova15viiNSDB0LLCxAQNm5rIpEvVx660Cmr?= =?koi8-r?Q?n7bKF4+OjE210eaLe3+buVZyhpsDWZekYZWueEVzbXTlVLnrAjuz/eUk5lZfrr?= =?koi8-r?Q?OY/c3y4lxat/GUS1ZIqqAeuXRd8U10khu8HMvPeP2WTSnUNs8p9yRLPx45R9FO?= =?koi8-r?Q?wk6Bx?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR08MB0750;6:3P+W8Bulg3OT8khDokigUxWL//2P8H3nB+cUS5VHFP9l0iPXI84blzyIkdq5DJ4iWzspmISh5Y8mBvisntBHi9rD6Efzdb1xRhsIzx+hhTm1+mTuINlHarT+6+5epA7RZlh2kg+PDYb8nOb8mYRZAcrcJoG5zdrlGlfFQtcV7FUDaQF4G0cC+YCBZw1ok5AEh6//x/nDetolmRFqFhpTN/La/hpWQzd6i2z29msIy7MxIPzh1IjyEtuIUN0YrW/gEctQlN68862uZl7Si1AKw863wG5mn6YveeyjCV8RD7F7EizGQ71uGgRNx/zVZCWMM5uRfAtAcE2lwpGlev6ZDHZplbRujH7ehqArUEQQDLQ=;5:LdOE1Bx7VAcCHn+njWXW7M42+k9c+yJLNQt2+03NvVnPkSkfL3UsRZ8Jxb5IFC30b6t6uwcHNyJb2ovWudjfK6EnY8b6v8c+4tjuALzjPHPH+cwFgSKIo62o0eb1KAS1or4cOaFzhEHmOMvxbLwEGv6t9riGZQgtLtv6EHQ1owU=;24:3jyPSpNMjIhLHmRvuUiVt1xI38822gud5S46CQoSqH+pYmGtPgVM2pwMQwKNOA6AitolxiqNB9jf8pkf3ywMBlm5w+FWr3qOHlZ7linRcCc=;7:2Z/pNI9fFaNe5RrMFQOKXWnXhFNJWJD0dLr/RQk3U8LaC0NCxQ8Mwja7Vcm9Epg/KDoc7mncTKNEWVs8qscv9q+8bQZ4iqqKc243pVvfvYUAhCvLk65NH1pOJ3KminiyeA6vdEb/jOGb2qR6+OWzsoWbknQumb+bf5P4uCWUoEG0XXJMv0qUI4mWT7QZmUUrDJ0xWVEf+d/rQvjVYhJkJW0MH43nITSrOt3V8Ntc81dQ7rxk1rnrxS7mj7R0K7e1 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;VI1PR08MB0750;20:Dfy5xNycHoBK/3In1uLR1VXfgsOtsGBe/5mZeljQ/u/CDIo2mvnNvAIbOA7Oh5mpeRZovoJdf/lIiAANCvboRtl24wnsdJMSELwl8yvbofrWbDyJiRokGzTHqe22vbIufZKqECHN1dUYPnnFGTgzWUQvRMdcCd9A3llPzZLtp+A= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Jan 2018 18:14:48.8144 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2977b64a-fd2e-4fb7-d843-08d5539f0cf8 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB0750 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Thu, Jan 04, 2018 at 01:01:17PM +0100, Dmitry Vyukov wrote: > On Wed, Jan 3, 2018 at 8:37 AM, Andrei Vagin wrote: > >> > Hello, > >> > > >> > syzkaller hit the following crash on > >> > 75aa5540627fdb3d8f86229776ea87f995275351 > >> > git://git.cmpxchg.org/linux-mmots.git/master > >> > compiler: gcc (GCC) 7.1.1 20170620 > >> > .config is attached > >> > Raw console output is attached. > >> > C reproducer is attached > >> > syzkaller reproducer is attached. See https://goo.gl/kgGztJ > >> > for information about syzkaller reproducers > >> > > >> > > >> > IMPORTANT: if you fix the bug, please add the following tag to the commit: > >> > Reported-by: syzbot+e432865c29eb4c48c142@syzkaller.appspotmail.com > >> > It will help syzbot understand when the bug is fixed. See footer for > >> > details. > >> > If you forward the report, please keep this part and the footer. > >> > > >> > netlink: 3 bytes leftover after parsing attributes in process > >> > `syzkaller140561'. > >> > netlink: 3 bytes leftover after parsing attributes in process > >> > `syzkaller140561'. > >> > netlink: 3 bytes leftover after parsing attributes in process > >> > `syzkaller140561'. > >> > kasan: CONFIG_KASAN_INLINE enabled > >> > kasan: GPF could be caused by NULL-ptr deref or user memory access > >> > general protection fault: 0000 [#1] SMP KASAN > >> > Dumping ftrace buffer: > >> > (ftrace buffer empty) > >> > Modules linked in: > >> > CPU: 1 PID: 3149 Comm: syzkaller140561 Not tainted 4.15.0-rc4-mm1+ #47 > >> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > >> > Google 01/01/2011 > >> > RIP: 0010:__netlink_ns_capable+0x8b/0x120 net/netlink/af_netlink.c:868 > >> > >> NETLINK_CB(skb).sk is NULL here. It looks like we have to use > >> sk_ns_capable instead of netlink_ns_capable: > >> > >> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c > >> index c688dc564b11..408c75de52ea 100644 > >> --- a/net/core/rtnetlink.c > >> +++ b/net/core/rtnetlink.c > >> @@ -1762,7 +1762,7 @@ static struct net *get_target_net(struct sk_buff > >> *skb, int netnsid) > >> /* For now, the caller is required to have CAP_NET_ADMIN in > >> * the user namespace owning the target net ns. > >> */ > >> - if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) { > >> + if (!sk_ns_capable(skb->sk, net->user_ns, CAP_NET_ADMIN)) { > >> put_net(net); > >> return ERR_PTR(-EACCES); > >> } > >> > > > > get_target_net() is used twice in the code. In rtnl_getlink(), we need > > to use netlink_ns_capable(skb, ...), but in rtnl_dump_ifinfo, we need to > > use sk_ns_capable(skb->sk, ...). > > > > Pls, take a look at this patch: > > https://patchwork.ozlabs.org/patch/854896/ > > Subject: rtnetlink: give a user socket to get_target_net() > > > Please include this tag into the commit: > I sent v2 with this tag. Sorry for inconvenience. https://patchwork.ozlabs.org/patch/855147/ > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > > Reported-by: syzbot+e432865c29eb4c48c142@syzkaller.appspotmail.com > > > It will help syzbot understand when the bug is fixed.