Re: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/netinet6/scope6.c:LINE, member access w

[Dmitry Vyukov <dvyukov%google.com@localhost>]

On Fri, Sep 20, 2019 at 3:39 AM Kamil Rytarowski <n54%gmx.com@localhost> wrote:
>
> On 20.09.2019 00:24, syzbot wrote:
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit:    338a6d82 Use an explicit run-time assertion where
> > compile-..
> > git tree:       netbsd
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1176d8e9600000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=824b23e1f4b6c76b
> > dashboard link:
> > https://syzkaller.appspot.com/bug?extid=b53a9bcf030288081e65
> >
> > Unfortunately, I don't have any reproducer for this crash yet.
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+b53a9bcf030288081e65%syzkaller.appspotmail.com@localhost
> >
> > [  47.4625386] panic: UBSan: Undefined Behavior in
> > /syzkaller/managers/netbsd-kubsan/kernel/sys/netinet6/scope6.c:480:6,
> > member access within misaligned address 0xffff9457bc441286 for type
> > 'struct in6_addr' which requires 4 byte alignment
> >
>
> How to address these reports? There are numbers of them.
>
> The problem is that struct in6_addr is stored in __packed structs such
> as (ip6_hdr) in the kernel. I don't know any other way to fix it than
> marking in6_addr as __packed, but that changes ABI and breaks userland
> qemu for some reason.
>
> FreeBSD/OpenBSD have the same structs and attributes.
>
> Illumos and Linux don't use __packed for ip6_hdr, but it is probably too
> late to change our struct layout?
>
> Also I don't have enough confidence of the ipv6 algorithms.
>
> One variation (valid ?) is to put back __packed under ifdef _KERNEL:
>
> http://netbsd.org/~kamil/patch-00151-ip6addr.txt
>
> Alternatively mark [probably too] many ipv6 related functions with
> __noubsan.
>
> This is probably the last UBSan issue before getting syzbot to fuzz the
> kernel.

FWIW one of official way to fix this in C/C++ is to declare a properly
aligned type (int) and copyout the data into it with memcpy. For x86
compiler should understand that and eliminate the copy.