linux-kernel - Re: KASAN: slab-out-of-bounds Read in bpf_skb_vlan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACT4Y+ZhMnjMd0E7V7Tv7HwFKqoeP078n-Q=ZScGMp3tLkrqmA@mail.gmail.com>
Date:   Thu, 14 Jun 2018 09:37:12 +0200
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Daniel Borkmann <daniel@...earbox.net>
Cc:     syzbot <syzbot+76de61614cb1abdd73fc@...kaller.appspotmail.com>,
        Alexei Starovoitov <ast@...nel.org>,
        David Miller <davem@...emloft.net>,
        LKML <linux-kernel@...r.kernel.org>,
        netdev <netdev@...r.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: Re: KASAN: slab-out-of-bounds Read in bpf_skb_vlan_push

On Wed, Jun 13, 2018 at 8:15 PM, Daniel Borkmann <daniel@...earbox.net> wrote:
> On 06/13/2018 08:13 PM, syzbot wrote:
>>> On 06/13/2018 06:17 PM, syzbot wrote:
>>>> Hello,
>>
>>>> syzbot found the following crash on:
>>
>>>> HEAD commit:    75d4e704fa8d netdev-FAQ: clarify DaveM's position for stab..
>>>> git tree:       bpf-next
>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=1754783f800000
>>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=a601a80fec461d44
>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=76de61614cb1abdd73fc
>>>> compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
>>>> syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=12c1e1bf800000
>>
>>>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>>>> Reported-by: syzbot+76de61614cb1abdd73fc@...kaller.appspotmail.com
>>
>>>> IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
>>>> IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
>>>> 8021q: adding VLAN 0 to HW filter on device team0
>>>> 8021q: adding VLAN 0 to HW filter on device team0
>>>> ==================================================================
>>>> BUG: KASAN: slab-out-of-bounds in skb_at_tc_ingress include/net/sch_generic.h:535 [inline]
>>>> BUG: KASAN: slab-out-of-bounds in bpf_push_mac_rcsum net/core/filter.c:1625 [inline]
>>>> BUG: KASAN: slab-out-of-bounds in ____bpf_skb_vlan_push net/core/filter.c:2446 [inline]
>>>> BUG: KASAN: slab-out-of-bounds in bpf_skb_vlan_push+0x6b7/0x720 net/core/filter.c:2437
>>>> Read of size 5 at addr ffff8801b77347d0 by task syz-executor6/6529
>>
>>> Should be fixed already by:
>>
>>>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58990d1ff3f7896ee341030e9a7c2e4002570683
>>
>>
>>> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>>
>> want 2 args (repo, branch), got 1
>
> Fair enough ... assumed default would have been master. ;-)

There is an issue with making defaults. Some email clients reflow
emails and split lines and git repo address can be lengthy and trigger
such reflow. To work around this syzbot currently looks for 2 "tokens"
after syz test, not necessary on the same line. The default for branch
will cause ambiguity in parsing: is it only repo without branch, or is
it repo with branch on the next line? Engineering hits reality...

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master