syzbot


panic: malformed IPv4 option passed to ip_optcopy

Status: fixed on 2019/01/08 00:18
Reported-by: syzbot+0361ed02deed123667cb@syzkaller.appspotmail.com
Fix commit: Validate the version, and all length fields of IP packets passed to a raw socket
First crash: 2165d, last: 2156d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: malformed IPv4 option passed to ip_optcopy (3) syz 40 261d 262d 3/3 fixed on 2024/03/05 23:45
openbsd panic: malformed IPv4 option passed to ip_optcopy (2) C 149 2136d 2139d 3/3 fixed on 2019/01/19 20:26

Sample crash report:
panic: malformed IPv4 option passed to ip_optcopy
Stopped at      db_enter+0xa:   popq    %rbp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 240244  90692      0         0x2          0    1  syz-executor7182
*221300  90692      0         0x2  0x4000000    0K syz-executor7182
db_enter() at db_enter+0xa sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x147 sys/kern/subr_prf.c:208
ip_fragment(ffffff0005fe9000,ffff800000173290,ffffff006efd9700) at ip_fragment+0x5f4
ip_output(ffffff006f2d9000,ffffff006efd9700,ffffff0005fe9000,22,1000,e03a3044e0550017) at ip_output+0xc6c sys/netinet/ip_output.c:501
rip_output(0,9,ffffff006e6fd908,0) at rip_output+0x187 sys/netinet/raw_ip.c:293
rip_usrreq(1000,ffffff006e6fd908,0,ffffff006efd9700,0,e03a3044e0550017) at rip_usrreq+0x3ed sys/netinet/raw_ip.c:472
sosend(ffffff006e48d620,ffff800021119318,1000,ffff8000211193c0,0,e03a3044e0550017) at sosend+0x46a sys/kern/uipc_socket.c:513
dofilewritev(ffff8000210a4970,ffff8000211193c0,1000,ffff8000211193d8,62a2c369ff8) at dofilewritev+0x13e sys/kern/sys_generic.c:364
sys_write(40,ffff8000210a4970,0) at sys_write+0x6e sys/kern/sys_generic.c:283
syscall(0) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:99 [inline]
syscall(0) at syscall+0x489 sys/arch/amd64/amd64/trap.c:583
Xsyscall(6,0,62a817bd4a0,0,62798b4a098,62798b4a090) at Xsyscall+0x128
end of kernel
end trace frame: 0x62a2c36a020, count: 4
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> show panic
malformed IPv4 option passed to ip_optcopy
ddb{0}> trace
db_enter() at db_enter+0xa sys/arch/amd64/amd64/db_interface.c:399
panic() at panic+0x147 sys/kern/subr_prf.c:208
ip_fragment(ffffff0005fe9000,ffff800000173290,ffffff006efd9700) at ip_fragment+0x5f4
ip_output(ffffff006f2d9000,ffffff006efd9700,ffffff0005fe9000,22,1000,e03a3044e0550017) at ip_output+0xc6c sys/netinet/ip_output.c:501
rip_output(0,9,ffffff006e6fd908,0) at rip_output+0x187 sys/netinet/raw_ip.c:293
rip_usrreq(1000,ffffff006e6fd908,0,ffffff006efd9700,0,e03a3044e0550017) at rip_usrreq+0x3ed sys/netinet/raw_ip.c:472
sosend(ffffff006e48d620,ffff800021119318,1000,ffff8000211193c0,0,e03a3044e0550017) at sosend+0x46a sys/kern/uipc_socket.c:513
dofilewritev(ffff8000210a4970,ffff8000211193c0,1000,ffff8000211193d8,62a2c369ff8) at dofilewritev+0x13e sys/kern/sys_generic.c:364
sys_write(40,ffff8000210a4970,0) at sys_write+0x6e sys/kern/sys_generic.c:283
syscall(0) at syscall+0x489 mi_syscall sys/sys/syscall_mi.h:99 [inline]
syscall(0) at syscall+0x489 sys/arch/amd64/amd64/trap.c:583
Xsyscall(6,0,62a817bd4a0,0,62798b4a098,62798b4a090) at Xsyscall+0x128
end of kernel
end trace frame: 0x62a2c36a020, count: -11
ddb{0}> show registers
rdi               0xffffffff81e20110    kprintf_mutex
rsi                              0x5
rbp               0xffff800021118f50
rbx               0xffff800021118ff0
rdx                            0x3fd
rcx                                0
rax                              0x1
r8                0xffff800021118f20
r9                                 0
r10                                0
r11               0xffffffff8197d380    x86_bus_space_io_read_1
r12                     0x3000000008
r13               0xffff800021118f60
r14                            0x100
r15               0xffffffff81c38636    apollo_udma100_tim+0xd631
rip               0xffffffff8182d81a    db_enter+0xa
cs                               0x8
rflags                         0x202
rsp               0xffff800021118f50
ss                              0x10
db_enter+0xa:   popq    %rbp
ddb{0}> show proc
PROC (syz-executor7182) pid=221300 stat=onproc
    flags process=2<EXEC> proc=4000000<THREAD>
    pri=51, usrpri=51, nice=20
    forw=0xffffffffffffffff, list=0xffff8000210a4718,0xffffffff81ebabf8
    process=0xffff8000210a7300 user=0xffff800021114000, vmspace=0xffffff007f124210
    estcpu=1, cpticks=1, pctcpu=0.0
    user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 90692  240244  75369      0  7         0x2                syz-executor7182
*90692  221300  75369      0  7   0x4000002                syz-executor7182
 75369  163534  14015      0  3    0x10008a  pause         ksh
 14015   59605  46217      0  3        0x92  select        sshd
 60858  311911      1      0  3    0x100083  ttyin         getty
 46217  482486      1      0  3        0x80  select        sshd
 51974   59267  85278     73  3    0x100090  kqread        syslogd
 85278   79216      1      0  3    0x100082  netio         syslogd
 93235  129952      1     77  3    0x100090  poll          dhclient
 90893   45340      1      0  3        0x80  poll          dhclient
  3626  353315      0      0  2     0x14200                zerothread
 99632   49372      0      0  3     0x14200  aiodoned      aiodoned
 70051  189025      0      0  3     0x14200  syncer        update
 94447  403790      0      0  3     0x14200  cleaner       cleaner
 16158  308297      0      0  3     0x14200  reaper        reaper
 22042    3036      0      0  3     0x14200  pgdaemon      pagedaemon
 57722  253800      0      0  3     0x14200  bored         crynlk
 41276  504436      0      0  3     0x14200  bored         crypto
 41465  240531      0      0  3  0x40014200  acpi0         acpi0
 92137  104984      0      0  3  0x40014200                idle1
 78872  449395      0      0  3     0x14200  bored         softnet
 21325  166296      0      0  3     0x14200  bored         systqmp
 89258   51153      0      0  3     0x14200  bored         systq
 72343  398068      0      0  3  0x40014200  bored         softclock
 53696  477841      0      0  3  0x40014200                idle0
     1  283596      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{0}> 

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/23 05:40 openbsd 907eae9ac960 e3bd7ab8 .config console log report syz C ci-openbsd-multicore
2018/12/22 22:27 openbsd afb6229dd599 e3bd7ab8 .config console log report syz ci-openbsd-main
2018/12/27 19:45 openbsd 01cfcf25097a e747ec98 .config console log report ci-openbsd-main
2018/12/26 22:15 openbsd 8ff5027431d5 82c9e677 .config console log report ci-openbsd-multicore
2018/12/25 09:27 openbsd d55171694444 8a41a0ad .config console log report ci-openbsd-main
2018/12/24 11:04 openbsd 1fcf050ad651 be79df56 .config console log report ci-openbsd-multicore
2018/12/24 00:43 openbsd 7d0170de3bc3 e3bd7ab8 .config console log report ci-openbsd-multicore
2018/12/23 05:24 openbsd 907eae9ac960 e3bd7ab8 .config console log report ci-openbsd-multicore
2018/12/22 22:09 openbsd afb6229dd599 e3bd7ab8 .config console log report ci-openbsd-main
2018/12/18 18:55 openbsd 9257d67bbd0d 4edaba93 .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.