lkml.org 
[lkml]   [2018]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[bug report] memory corruption panic caused by SG_IO ioctl()
Date
<html>
<head>

<meta http-equiv="content-type" content="text/html; charset=windows-1252">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</p>
<p>
<meta name="ProgId" content="OneNote.File">
<meta name="Generator" content="Microsoft OneNote 15">
<p style="margin:0in;font-family:Calibri"><span
style="font-size:10.0pt" lang="en-US">Hi </span><span
style="font-size:10.5pt" lang="zh-CN">Martin</span><span
style="font-size:10.5pt" lang="en-US"> and all folks,</span></p>
<p style="margin:0in;font-family:Calibri"><span
style="font-size:10.5pt" lang="en-US"><br>
</span></p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt">Recently
we find a
kernel panic with memory corruption caused by SG_IO ioctl(), and
it can be
easily reproduced by running following reproducer about minutes,<span
style="mso-spacerun:yes">  </span>any idea?</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"> </p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt">Thanks,</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt">Wanlong</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"><br>
</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"><br>
</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">C
reproducer:</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">//
autogenerated by syzkaller (<a
href="http://github.com/google/syzkaller">http://github.com/google/syzkaller</a>)</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN"> </p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">#define
_GNU_SOURCE </p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">#include
&lt;endian.h&gt;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">#include
&lt;sys/syscall.h&gt;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">#include
&lt;unistd.h&gt;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">#include
&lt;fcntl.h&gt;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">#include
&lt;stdio.h&gt;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">#include
&lt;string.h&gt;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">#include
&lt;sys/stat.h&gt;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">#include
&lt;stdint.h&gt;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">#include
&lt;string.h&gt;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN"> </p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">static
uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2)</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">{</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">if (a0 == 0xc || a0 == 0xb) {</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">char buf[128];</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char"
: "block", (uint8_t)a1, (uint8_t)a2);</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">return open(buf, O_RDWR, 0);</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">} else {</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">char buf[1024];</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">char* hash;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">strncpy(buf,
(char*)a0, sizeof(buf) - 1);</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">buf[sizeof(buf) - 1] = 0;</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">while ((hash = strchr(buf, '#'))) {</p>
<p
style="margin:0in;margin-left:1.125in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*hash = '0' + (char)(a1 % 10);</p>
<p
style="margin:0in;margin-left:1.125in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">a1 /= 10;</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">}</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">return open(buf, a2, 0);</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">}</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">}</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN"> </p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">static
void execute_one();</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">extern
unsigned long long procid;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN"> </p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">void
loop()</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">{</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">while (1) {</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">execute_one();</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">}</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">}</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN"> </p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">uint64_t
r[1] = {0xffffffffffffffff};</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">void
execute_one()</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">{</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">long res = 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">memcpy((void*)0x20000040,
"/dev/sg#", 9);</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">res = syz_open_dev(0x20000040, 0, 0);</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">if (res != -1)</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">r[0] = res;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint32_t*)0x200002c0
= 0x53;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint32_t*)0x200002c4
= 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint8_t*)0x200002c8
= 0xd;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint8_t*)0x200002c9
= 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint16_t*)0x200002ca
= 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint32_t*)0x200002cc
= 0x95;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint64_t*)0x200002d0
= 0x20000080;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint64_t*)0x200002d8
= 0x20000000;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">memcpy((void*)0x20000000,
"\x08\xf0\xa8\x77\xd3\xbe\x87\x5d\xda\x65\x79\x3f\xc7", 13);</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint64_t*)0x200002e0
= 0x20000180;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint32_t*)0x200002e8
= 0x8001;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint32_t*)0x200002ec
= 0x10024;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint32_t*)0x200002f0
= -1;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint64_t*)0x200002f4
= 0x20000280;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint8_t*)0x200002fc
= 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint8_t*)0x200002fd
= 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint8_t*)0x200002fe
= 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint8_t*)0x200002ff
= 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint16_t*)0x20000300
= 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint16_t*)0x20000302
= 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint32_t*)0x20000304
= 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint32_t*)0x20000308
= 0;</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">*(uint32_t*)0x2000030c
= 0;</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">syscall(__NR_ioctl, r[0], 0x2285, 0x200002c0);</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">}</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN"> </p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">int
main()</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">{</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32,
-1, 0);</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">for (;;) {</p>
<p
style="margin:0in;margin-left:.75in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">loop();</p>
<p
style="margin:0in;margin-left:.375in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">}</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"
lang="zh-CN">}</p>
<p style="margin:0in;font-family:Calibri;font-size:10.5pt"> </p>
</p>
</body>
</html>

\
 
 \ /
  Last update: 2018-08-03 10:48    [W:0.053 / U:2.392 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site