linux-kernel - Re: [syzbot] [net?] [virt?] [kvm?] KASAN: slab-use-after-free Read in __vhost_vq_attach

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZKx509XelfwPIkhX@google.com>
Date:   Mon, 10 Jul 2023 14:36:19 -0700
From:   Sean Christopherson <seanjc@...gle.com>
To:     "Michael S. Tsirkin" <mst@...hat.com>
Cc:     Mike Christie <michael.christie@...cle.com>,
        syzbot <syzbot+8540db210d403f1aa214@...kaller.appspotmail.com>,
        jasowang@...hat.com, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com,
        virtualization@...ts.linux-foundation.org
Subject: Re: [syzbot] [net?] [virt?] [kvm?] KASAN: slab-use-after-free Read in __vhost_vq_attach_worker

On Mon, Jun 26, 2023, Michael S. Tsirkin wrote:
> On Mon, Jun 26, 2023 at 10:03:25AM -0500, Mike Christie wrote:
> > On 6/26/23 2:15 AM, Michael S. Tsirkin wrote:
> > > On Mon, Jun 26, 2023 at 12:06:54AM -0700, syzbot wrote:
> > >> Hello,
> > >>
> > >> syzbot found the following issue on:
> > >>
> > >> HEAD commit:    8d2be868b42c Add linux-next specific files for 20230623
> > >> git tree:       linux-next
> > >> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12872950a80000
> > >> kernel config:  https://syzkaller.appspot.com/x/.config?x=d8ac8dd33677e8e0
> > >> dashboard link: https://syzkaller.appspot.com/bug?extid=8540db210d403f1aa214
> > >> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> > >> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15c1b70f280000
> > >> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=122ee4cb280000
> > >>
> > >> Downloadable assets:
> > >> disk image: https://storage.googleapis.com/syzbot-assets/2a004483aca3/disk-8d2be868.raw.xz
> > >> vmlinux: https://storage.googleapis.com/syzbot-assets/5688cb13b277/vmlinux-8d2be868.xz
> > >> kernel image: https://storage.googleapis.com/syzbot-assets/76de0b63bc53/bzImage-8d2be868.xz
> > >>
> > >> The issue was bisected to:
> > >>
> > >> commit 21a18f4a51896fde11002165f0e7340f4131d6a0
> > >> Author: Mike Christie <michael.christie@...cle.com>
> > >> Date:   Tue Jun 13 01:32:46 2023 +0000
> > >>
> > >>     vhost: allow userspace to create workers
> > >>
> > >> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=130850bf280000
> > >> final oops:     https://syzkaller.appspot.com/x/report.txt?x=108850bf280000
> > >> console output: https://syzkaller.appspot.com/x/log.txt?x=170850bf280000
> > >>
> > >> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > >> Reported-by: syzbot+8540db210d403f1aa214@...kaller.appspotmail.com
> > >> Fixes: 21a18f4a5189 ("vhost: allow userspace to create workers")
> > > 
> > > Mike, would appreciate prompt attention to this as I am preparing
> > > a pull request for the merge window and need to make a
> > > decision on whether to include your userspace-controlled
> > > threading patchset.
> > > 
> > 
> > Do you want me to resubmit the patchset or submit a patch against your vhost
> > branch?
> 
> Resubmit pls.

Closing this out from syzbot's perspective since v9 (now in linux-next and Linus'
tree) added back Mike's fix.

#syz invalid