linux-kernel - Re: [syzbot] KASAN: use-after-free Read in __crypto

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 3 Sep 2021 21:33:20 -0400
From:   Daniel Jordan <daniel.m.jordan@...cle.com>
To:     syzbot <syzbot+b187b77c8474f9648fae@...kaller.appspotmail.com>
Cc:     akpm@...ux-foundation.org, davem@...emloft.net,
        herbert@...dor.apana.org.au, josh@...htriplett.org,
        linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
        netdev@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        torvalds@...ux-foundation.org
Subject: Re: [syzbot] KASAN: use-after-free Read in __crypto_xor

On Thu, Sep 02, 2021 at 04:36:25PM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    3e12361b6d23 bcm63xx_enet: delete a redundant assignment
> git tree:       net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=160cec72300000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=63a23a80f42a8989
> dashboard link: https://syzkaller.appspot.com/bug?extid=b187b77c8474f9648fae
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=144d07b6300000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=171b7fca300000
> 
> The issue was bisected to:
> 
> commit 4611ce22468895acd61fee9ac1da810d60617d9a
> Author: Daniel Jordan <daniel.m.jordan@...cle.com>
> Date:   Wed Jun 3 22:59:39 2020 +0000
> 
>     padata: allocate work structures for parallel jobs from a pool
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=118dccae300000
> console output: https://syzkaller.appspot.com/x/log.txt?x=158dccae300000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b187b77c8474f9648fae@...kaller.appspotmail.com
> Fixes: 4611ce224688 ("padata: allocate work structures for parallel jobs from a pool")
> 
> ==================================================================
> BUG: KASAN: use-after-free in __crypto_xor+0x376/0x410 crypto/algapi.c:1001
> Read of size 8 at addr ffff88803691a000 by task kworker/u4:1/10

The reproducer hasn't tripped over this yet, but I'll keep trying.