lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 10 Mar 2020 11:33:56 -0700 From: Cong Wang <xiyou.wangcong@...il.com> To: syzbot <syzbot+dcc34d54d68ef7d2d53d@...kaller.appspotmail.com> Cc: David Miller <davem@...emloft.net>, Jamal Hadi Salim <jhs@...atatu.com>, Jiri Pirko <jiri@...nulli.us>, Jakub Kicinski <kuba@...nel.org>, LKML <linux-kernel@...r.kernel.org>, Linux Kernel Network Developers <netdev@...r.kernel.org>, syzkaller-bugs <syzkaller-bugs@...glegroups.com> Subject: Re: KASAN: invalid-free in tcf_exts_destroy On Sun, Mar 8, 2020 at 12:35 PM syzbot <syzbot+dcc34d54d68ef7d2d53d@...kaller.appspotmail.com> wrote: > > Hello, > > syzbot found the following crash on: > > HEAD commit: c2003765 Merge tag 'io_uring-5.6-2020-03-07' of git://git... > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=10cd2ae3e00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=4527d1e2fb19fd5c > dashboard link: https://syzkaller.appspot.com/bug?extid=dcc34d54d68ef7d2d53d > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > userspace arch: i386 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1561b01de00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15aad2f9e00000 > > The bug was bisected to: > > commit 599be01ee567b61f4471ee8078870847d0a11e8e > Author: Cong Wang <xiyou.wangcong@...il.com> > Date: Mon Feb 3 05:14:35 2020 +0000 > > net_sched: fix an OOB access in cls_tcindex > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10a275fde00000 > final crash: https://syzkaller.appspot.com/x/report.txt?x=12a275fde00000 > console output: https://syzkaller.appspot.com/x/log.txt?x=14a275fde00000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+dcc34d54d68ef7d2d53d@...kaller.appspotmail.com > Fixes: 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") > > IPVS: ftp: loaded support on port[0] = 21 > ================================================================== > BUG: KASAN: double-free or invalid-free in tcf_exts_destroy+0x62/0xc0 net/sched/cls_api.c:3002 > > CPU: 1 PID: 9507 Comm: syz-executor467 Not tainted 5.6.0-rc4-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x188/0x20d lib/dump_stack.c:118 > print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:374 > kasan_report_invalid_free+0x61/0xa0 mm/kasan/report.c:468 > __kasan_slab_free+0x129/0x140 mm/kasan/common.c:455 > __cache_free mm/slab.c:3426 [inline] > kfree+0x109/0x2b0 mm/slab.c:3757 > tcf_exts_destroy+0x62/0xc0 net/sched/cls_api.c:3002 > tcf_exts_change+0xf4/0x150 net/sched/cls_api.c:3059 > tcindex_set_parms+0xed8/0x1a00 net/sched/cls_tcindex.c:456 Looks like a consequence of "slab-out-of-bounds Write in tcindex_set_parms". Thanks.
Powered by blists - more mailing lists