CPU DoS (infinite loop) in sctp_send_cookie_echo

[markwo]

While working on a fuzzer for usrsctp, I hit a timeout due to an infinite loop in the target/receiver endpoint. The PCAP is attached - output and stack trace of the timeout are below. From a look at the code, this is due to the code in sctp_send_cookie_echo (sctp_output.c) not handling parameters with a zero length:

        for (;;) {
                phdr = sctp_get_next_param(m, at, &param, sizeof(param));
                if (phdr == NULL) {
                        return (-3);
                }
                ptype = ntohs(phdr->param_type);
                plen = ntohs(phdr->param_length);
                if (ptype == SCTP_STATE_COOKIE) {
                ...
                }
                at += SCTP_SIZE32(plen);

I'm cleaning up the fuzzer currently - can share the code if you need it to repro. (Would also like to eventually get this fuzzer added to the repo as an OSS-Fuzz target).

ALARM: working on the last Unit for 5 seconds
       and the timeout value is 5 (use -timeout=N to change)
==102223== ERROR: libFuzzer: timeout after 5 seconds
    #0 0x55a619edd351 in __sanitizer_print_stack_trace third_party/llvm/llvm/projects/compiler-rt/lib/asan/asan_stack.cpp:86:3
    #1 0x55a61a0d8bc8 in fuzzer::PrintStackTrace() third_party/llvm/llvm/projects/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:205:5
    #2 0x55a61a0bcae6 in fuzzer::Fuzzer::AlarmCallback() third_party/llvm/llvm/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:300:5
    #3 0x7f5b5a73599f  (/usr/grte/v4/lib64/libpthread.so.0+0xf99f)
    #4 0x55a619fc3541 in sctp_send_cookie_echo third_party/usrsctp/usrsctplib/netinet/sctp_output.c:9495:10
    #5 0x55a619f5f5d2 in sctp_process_init_ack third_party/usrsctp/usrsctplib/netinet/sctp_input.c:580:11
    #6 0x55a619f5399c in sctp_handle_init_ack third_party/usrsctp/usrsctplib/netinet/sctp_input.c:1515:7
    #7 0x55a619f50c3f in sctp_process_control third_party/usrsctp/usrsctplib/netinet/sctp_input.c:5087:11
    #8 0x55a619f71cbe in sctp_common_input_processing third_party/usrsctp/usrsctplib/netinet/sctp_input.c:5886:10
    #9 0x55a619f0cd17 in usrsctp_conninput third_party/usrsctp/usrsctplib/user_socket.c:3478:2
    #10 0x55a619ef9a5a in usrsctp_fuzzer::SctpSocket::SctpSocket()::$_0::operator()(std::__u::unique_ptr<RawBuffer, std::__u::default_delete<RawBuffer> >) const third_party/usrsctp/fuzzer/usrsctp_fuzzer.cc:152:46
    #11 0x55a619ef9921 in decltype(std::__u::forward<usrsctp_fuzzer::SctpSocket::SctpSocket()::$_0&>(fp)(std::__u::forward<std::__u::unique_ptr<RawBuffer, std::__u::default_delete<RawBuffer> > >(fp0))) std::__u::__invoke<usrsctp_fuzzer::SctpSocket::SctpSocket()::$_0&, std::__u::unique_ptr<RawBuffer, std::__u::default_delete<RawBuffer> > >(usrsctp_fuzzer::SctpSocket::SctpSocket()::$_0&, std::__u::unique_ptr<RawBuffer, std::__u::default_delete<RawBuffer> >&&) third_party/crosstool/v18/stable/toolchain/bin/../include/c++/v1/type_traits:3530:1
    #12 0x55a619eee590 in usrsctp_fuzzer::MessageSocket::ReceiveData(std::__u::unique_ptr<RawBuffer, std::__u::default_delete<RawBuffer> >) third_party/usrsctp/fuzzer/usrsctp_fuzzer.cc:103:5
    #13 0x55a619efbe91 in usrsctp_fuzzer::SctpFuzzer::SetUp()::$_2::operator()(std::__u::unique_ptr<RawBuffer, std::__u::default_delete<RawBuffer> >) const third_party/usrsctp/fuzzer/usrsctp_fuzzer.cc:410:19
    #14 0x55a619efbcc1 in decltype(std::__u::forward<usrsctp_fuzzer::SctpFuzzer::SetUp()::$_2&>(fp)(std::__u::forward<std::__u::unique_ptr<RawBuffer, std::__u::default_delete<RawBuffer> > >(fp0))) std::__u::__invoke<usrsctp_fuzzer::SctpFuzzer::SetUp()::$_2&, std::__u::unique_ptr<RawBuffer, std::__u::default_delete<RawBuffer> > >(usrsctp_fuzzer::SctpFuzzer::SetUp()::$_2&, std::__u::unique_ptr<RawBuffer, std::__u::default_delete<RawBuffer> >&&) third_party/crosstool/v18/stable/toolchain/bin/../include/c++/v1/type_traits:3530:1
    #15 0x55a619eee9b5 in usrsctp_fuzzer::MessageSocket::ProcessNextWriteInQueue() third_party/usrsctp/fuzzer/usrsctp_fuzzer.cc:119:3
    #16 0x55a619ef0dbc in usrsctp_fuzzer::SctpFuzzer::PumpMessages() third_party/usrsctp/fuzzer/usrsctp_fuzzer.cc:719:22
    #17 0x55a619ef28c4 in LLVMFuzzerTestOneInput third_party/usrsctp/fuzzer/usrsctp_fuzzer.cc:757:8
    #18 0x55a61a0be326 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/llvm/llvm/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:554:15
    #19 0x55a61a0a8439 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/llvm/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:292:6
    #20 0x55a61a0ad67e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/llvm/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:775:9
    #21 0x55a61a0c6e82 in main third_party/llvm/llvm/projects/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #22 0x7f5b5a5a3bbc in __libc_start_main (/usr/grte/v4/lib64/libc.so.6+0x38bbc)
    #23 0x55a619e3c768 in _start /usr/grte/v4/debug-src/src/csu/../sysdeps/x86_64/start.S:108

repro.zip

[tuexen]

Reproducible with the following packetdrill script:

 0.0 socket(..., SOCK_STREAM, IPPROTO_SCTP) = 3
+0.0 bind(3, ..., ...) = 0
+0.0 fcntl(3, F_GETFL) = 0x02 (flags O_RDWR)
+0.0 fcntl(3, F_SETFL, O_RDWR | O_NONBLOCK) = 0
+0.1 connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress)
+0.0 > sctp: INIT[flgs=0, tag=1, a_rwnd=..., os=..., is=..., tsn=0, ...]
+0.0 < sctp: [0x02, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x05, 0xDC, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x29, 0x00, 0x00, 0x08, 0x01, 0x02, 0x03, 0x04, 0x00, 0x06, 0x00, 0x00]
+0.0 close(3) = 0

[tuexen]

@markwo a5ce87d should fix the issue. Can you retest and confirm?

[markwo]

I can confirm this fixes the issue, thanks!