linux-kernel - Re: [syzbot] [hams?] KASAN: slab-use-after-free Read in rose_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250624124408.28785-1-enjuk@amazon.com>
Date: Tue, 24 Jun 2025 21:43:20 +0900
From: Kohei Enju <enjuk@...zon.com>
To: <syzbot+e04e2c007ba2c80476cb@...kaller.appspotmail.com>
CC: <linux-kernel@...r.kernel.org>, <syzkaller-bugs@...glegroups.com>
Subject: Re: [syzbot] [hams?] KASAN: slab-use-after-free Read in rose_get_neigh

#syz test

diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 2dd6bd3a3011..a85969e2369f 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -480,6 +480,7 @@ void rose_rt_device_down(struct net_device *dev)
 	struct rose_neigh *s, *rose_neigh;
 	struct rose_node  *t, *rose_node;
 	int i;
+	unsigned char old_count;
 
 	spin_lock_bh(&rose_node_list_lock);
 	spin_lock_bh(&rose_neigh_list_lock);
@@ -497,7 +498,8 @@ void rose_rt_device_down(struct net_device *dev)
 			t         = rose_node;
 			rose_node = rose_node->next;
 
-			for (i = 0; i < t->count; i++) {
+			old_count = t->count;
+			for (i = 0; i < old_count; i++) {
 				if (t->neighbour[i] != s)
 					continue;