Messages in this thread | | | From | Wanlong Gao <> | Subject | [bug report] memory corruption panic caused by SG_IO ioctl() | Date | Fri, 3 Aug 2018 16:46:57 +0800 |
| |
<html> <head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252"> </head> <body bgcolor="#FFFFFF" text="#000000"> <p> <meta http-equiv="Content-Type" content="text/html; charset=windows-1252"> </p> <p> <meta name="ProgId" content="OneNote.File"> <meta name="Generator" content="Microsoft OneNote 15"> <p style="margin:0in;font-family:Calibri"><span style="font-size:10.0pt" lang="en-US">Hi </span><span style="font-size:10.5pt" lang="zh-CN">Martin</span><span style="font-size:10.5pt" lang="en-US"> and all folks,</span></p> <p style="margin:0in;font-family:Calibri"><span style="font-size:10.5pt" lang="en-US"><br> </span></p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt">Recently we find a kernel panic with memory corruption caused by SG_IO ioctl(), and it can be easily reproduced by running following reproducer about minutes,<span style="mso-spacerun:yes"> </span>any idea?</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt"> </p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt">Thanks,</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt">Wanlong</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt"><br> </p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt"><br> </p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">C reproducer:</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">// autogenerated by syzkaller (<a href="http://github.com/google/syzkaller">http://github.com/google/syzkaller</a>)</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN"> </p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">#define _GNU_SOURCE </p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">#include <endian.h></p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">#include <sys/syscall.h></p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">#include <unistd.h></p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">#include <fcntl.h></p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">#include <stdio.h></p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">#include <string.h></p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">#include <sys/stat.h></p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">#include <stdint.h></p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">#include <string.h></p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN"> </p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2)</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">{</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">if (a0 == 0xc || a0 == 0xb) {</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">char buf[128];</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2);</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">return open(buf, O_RDWR, 0);</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">} else {</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">char buf[1024];</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">char* hash;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">strncpy(buf, (char*)a0, sizeof(buf) - 1);</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">buf[sizeof(buf) - 1] = 0;</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">while ((hash = strchr(buf, '#'))) {</p> <p style="margin:0in;margin-left:1.125in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*hash = '0' + (char)(a1 % 10);</p> <p style="margin:0in;margin-left:1.125in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">a1 /= 10;</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">}</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">return open(buf, a2, 0);</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">}</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">}</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN"> </p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">static void execute_one();</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">extern unsigned long long procid;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN"> </p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">void loop()</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">{</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">while (1) {</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">execute_one();</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">}</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">}</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN"> </p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">uint64_t r[1] = {0xffffffffffffffff};</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">void execute_one()</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">{</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">long res = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">memcpy((void*)0x20000040, "/dev/sg#", 9);</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">res = syz_open_dev(0x20000040, 0, 0);</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">if (res != -1)</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">r[0] = res;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint32_t*)0x200002c0 = 0x53;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint32_t*)0x200002c4 = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint8_t*)0x200002c8 = 0xd;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint8_t*)0x200002c9 = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint16_t*)0x200002ca = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint32_t*)0x200002cc = 0x95;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint64_t*)0x200002d0 = 0x20000080;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint64_t*)0x200002d8 = 0x20000000;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">memcpy((void*)0x20000000, "\x08\xf0\xa8\x77\xd3\xbe\x87\x5d\xda\x65\x79\x3f\xc7", 13);</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint64_t*)0x200002e0 = 0x20000180;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint32_t*)0x200002e8 = 0x8001;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint32_t*)0x200002ec = 0x10024;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint32_t*)0x200002f0 = -1;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint64_t*)0x200002f4 = 0x20000280;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint8_t*)0x200002fc = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint8_t*)0x200002fd = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint8_t*)0x200002fe = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint8_t*)0x200002ff = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint16_t*)0x20000300 = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint16_t*)0x20000302 = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint32_t*)0x20000304 = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint32_t*)0x20000308 = 0;</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">*(uint32_t*)0x2000030c = 0;</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">syscall(__NR_ioctl, r[0], 0x2285, 0x200002c0);</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">}</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN"> </p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">int main()</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">{</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">for (;;) {</p> <p style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">loop();</p> <p style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">}</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt" lang="zh-CN">}</p> <p style="margin:0in;font-family:Calibri;font-size:10.5pt"> </p> </p> </body> </html>
| |