linux-kernel - Re: [syzbot] [bpf?] [net?] KASAN: slab-use-after-free Read in nla

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20231218151705.7861913d@kernel.org>
Date: Mon, 18 Dec 2023 15:17:05 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: syzbot <syzbot+f43a23b6e622797c7a28@...kaller.appspotmail.com>
Cc: andrii@...nel.org, ast@...nel.org, bpf@...r.kernel.org,
 daniel@...earbox.net, davem@...emloft.net, edumazet@...gle.com,
 haoluo@...gle.com, john.fastabend@...il.com, jolsa@...nel.org,
 keescook@...omium.org, kpsingh@...nel.org, linux-kernel@...r.kernel.org,
 martin.lau@...ux.dev, netdev@...r.kernel.org, pabeni@...hat.com,
 sdf@...gle.com, song@...nel.org, syzkaller-bugs@...glegroups.com,
 yonghong.song@...ux.dev
Subject: Re: [syzbot] [bpf?] [net?] KASAN: slab-use-after-free Read in
 nla_find

On Mon, 18 Dec 2023 06:43:26 -0800 syzbot wrote:
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
>  print_address_description mm/kasan/report.c:364 [inline]
>  print_report+0xc4/0x620 mm/kasan/report.c:475
>  kasan_report+0xda/0x110 mm/kasan/report.c:588
>  nla_ok include/net/netlink.h:1230 [inline]
>  nla_find+0x120/0x130 lib/nlattr.c:746
>  nla_find_nested include/net/netlink.h:1260 [inline]
>  ____bpf_skb_get_nlattr_nest net/core/filter.c:209 [inline]

This needs nla_ok() instead of playing with nla_len directly.
Will send a fix soon..