linux-kernel - Re: [syzbot] [net?] KASAN: slab-use-after-free Read in tcp_prune_ofo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250716004459.2148-1-hdanton@sina.com>
Date: Wed, 16 Jul 2025 08:44:58 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+9d2a6ef56c3805144bf0@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] KASAN: slab-use-after-free Read in tcp_prune_ofo_queue

> Date: Tue, 15 Jul 2025 14:46:36 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    55e8757c6962 Merge branch 'net-mctp-improved-bind-handling'
> git tree:       net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=15834382580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f8235fb7e74dd7f6
> dashboard link: https://syzkaller.appspot.com/bug?extid=9d2a6ef56c3805144bf0
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1445058c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=148e098c580000

#syz test

--- x/net/ipv4/tcp_input.c
+++ y/net/ipv4/tcp_input.c
@@ -5514,14 +5514,16 @@ static bool tcp_prune_ofo_queue(struct s
 		prev = rb_prev(node);
 		rb_erase(node, &tp->out_of_order_queue);
 		goal -= skb->truesize;
-		tcp_drop_reason(sk, skb, SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE);
 		tp->ooo_last_skb = rb_to_skb(prev);
 		if (!prev || goal <= 0) {
 			if (tcp_can_ingest(sk, skb) &&
-			    !tcp_under_memory_pressure(sk))
+			    !tcp_under_memory_pressure(sk)) {
+				tcp_drop_reason(sk, skb, SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE);
 				break;
+			}
 			goal = sk->sk_rcvbuf >> 3;
 		}
+		tcp_drop_reason(sk, skb, SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE);
 		node = prev;
 	} while (node);
 
--