linux-kernel - Reminder: 6 open syzbot bugs in "net/dccp" subsystem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20190702061818.GE27702@sol.localdomain>
Date:   Mon, 1 Jul 2019 23:18:18 -0700
From:   Eric Biggers <ebiggers@...nel.org>
To:     dccp@...r.kernel.org, netdev@...r.kernel.org,
        Gerrit Renker <gerrit@....abdn.ac.uk>,
        "David S. Miller" <davem@...emloft.net>
Cc:     linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Reminder: 6 open syzbot bugs in "net/dccp" subsystem

[This email was generated by a script.  Let me know if you have any suggestions
to make it better, or if you want it re-generated with the latest status.]

Of the currently open syzbot reports against the upstream kernel, I've manually
marked 6 of them as possibly being bugs in the "net/dccp" subsystem.  I've
listed these reports below, sorted by an algorithm that tries to list first the
reports most likely to be still valid, important, and actionable.

Of these 6 bugs, 1 was seen in mainline in the last week.

If you believe a bug is no longer valid, please close the syzbot report by
sending a '#syz fix', '#syz dup', or '#syz invalid' command in reply to the
original thread, as explained at https://goo.gl/tpsmEJ#status

If you believe I misattributed a bug to the "net/dccp" subsystem, please let me
know, and if possible forward the report to the correct people or mailing list.

Here are the bugs:

--------------------------------------------------------------------------------
Title:              BUG: please report to dccp@...r.kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:LINE/tfrc_rx_hist_sample_rtt()
Last occurred:      3 days ago
Reported:           603 days ago
Branches:           Mainline and others
Dashboard link:     https://syzkaller.appspot.com/bug?id=0881c535c265ca965edc49c0ac3d0a9850d26eb1
Original thread:    https://groups.google.com/d/msgid/syzkaller-bugs/94eb2c05611406f6a5055d38a272%40google.com

This bug has a C reproducer.

For some reason the original report email for this bug is missing from the LKML
archive at lore.kernel.org, so my script couldn't check whether anyone has
replied to it or not.  The Google Groups link above should still work, though. 
Also try searching for the bug title.

--------------------------------------------------------------------------------
Title:              KASAN: use-after-free Read in ccid2_hc_tx_packet_recv
Last occurred:      4 days ago
Reported:           455 days ago
Branches:           Mainline and others
Dashboard link:     https://syzkaller.appspot.com/bug?id=31f032fe94df7aca6ce5d45455f6acefa26515e4
Original thread:    https://lkml.kernel.org/lkml/0000000000003872fd0568da185f@google.com/T/#u

This bug has a C reproducer.

No one replied to the original thread for this bug.

If you fix this bug, please add the following tag to the commit:
    Reported-by: syzbot+554ccde221001ab5479a@...kaller.appspotmail.com

If you send any email or patch for this bug, please consider replying to the
original thread.  For the git send-email command to use, or tips on how to reply
if the thread isn't in your mailbox, see the "Reply instructions" at
https://lkml.kernel.org/r/0000000000003872fd0568da185f@google.com

--------------------------------------------------------------------------------
Title:              KASAN: use-after-free Read in ccid_hc_tx_delete
Last occurred:      45 days ago
Reported:           308 days ago
Branches:           Mainline and others
Dashboard link:     https://syzkaller.appspot.com/bug?id=3e769c60cb2d1cab692fd541dae957b1fd31bde4
Original thread:    https://lkml.kernel.org/lkml/000000000000de3c7705746dcbb7@google.com/T/#u

This bug has a C reproducer.

No one replied to the original thread for this bug.

If you fix this bug, please add the following tag to the commit:
    Reported-by: syzbot+3967c1caf256f4d5aefe@...kaller.appspotmail.com

If you send any email or patch for this bug, please consider replying to the
original thread.  For the git send-email command to use, or tips on how to reply
if the thread isn't in your mailbox, see the "Reply instructions" at
https://lkml.kernel.org/r/000000000000de3c7705746dcbb7@google.com

--------------------------------------------------------------------------------
Title:              KMSAN: uninit-value in dccp_invalid_packet
Last occurred:      437 days ago
Reported:           438 days ago
Branches:           Mainline (with KMSAN patches)
Dashboard link:     https://syzkaller.appspot.com/bug?id=89916fdba284272cdbd0bf00de942f41d052c3f4
Original thread:    https://lkml.kernel.org/lkml/0000000000000e2bf3056a36962d@google.com/T/#u

This bug has a C reproducer.

No one replied to the original thread for this bug.

If you fix this bug, please add the following tag to the commit:
    Reported-by: syzbot+00763607efc31f91b276@...kaller.appspotmail.com

If you send any email or patch for this bug, please consider replying to the
original thread.  For the git send-email command to use, or tips on how to reply
if the thread isn't in your mailbox, see the "Reply instructions" at
https://lkml.kernel.org/r/0000000000000e2bf3056a36962d@google.com

--------------------------------------------------------------------------------
Title:              suspicious RCU usage at ./include/net/inet_sock.h:LINE
Last occurred:      513 days ago
Reported:           603 days ago
Branches:           Mainline and others
Dashboard link:     https://syzkaller.appspot.com/bug?id=78f9fe251de26a75a60690bc2384d62d2db32299
Original thread:    https://groups.google.com/d/msgid/syzkaller-bugs/001a1140ad88c4f006055d3836d2%40google.com

This bug has a C reproducer.

For some reason the original report email for this bug is missing from the LKML
archive at lore.kernel.org, so my script couldn't check whether anyone has
replied to it or not.  The Google Groups link above should still work, though. 
Also try searching for the bug title.

--------------------------------------------------------------------------------
Title:              WARNING: suspicious RCU usage in pid_task
Last occurred:      280 days ago
Reported:           380 days ago
Branches:           Mainline and others
Dashboard link:     https://syzkaller.appspot.com/bug?id=5b9f20bfdfb67155f627c5e13c258ca56eff026a
Original thread:    https://lkml.kernel.org/lkml/0000000000002b532a056ebcb3eb@google.com/T/#u

This bug has a C reproducer.

The original thread for this bug received 1 reply, 301 days ago.

If you fix this bug, please add the following tag to the commit:
    Reported-by: syzbot+c2d4c3ae3fd90bbaf059@...kaller.appspotmail.com

If you send any email or patch for this bug, please consider replying to the
original thread.  For the git send-email command to use, or tips on how to reply
if the thread isn't in your mailbox, see the "Reply instructions" at
https://lkml.kernel.org/r/0000000000002b532a056ebcb3eb@google.com