linux-kernel - Re: [syzbot] [virt?] upstream test error: KMSAN: use-after-free in vring_map_one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3480dcc9-a41a-4ae6-960d-4a13eed359e2@redhat.com>
Date: Mon, 13 Oct 2025 10:17:05 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: "Michael S. Tsirkin" <mst@...hat.com>
Cc: Jason Wang <jasowang@...hat.com>,
 syzbot <syzbot+ac856b8b866cca41352c@...kaller.appspotmail.com>,
 eperezma@...hat.com, linux-kernel@...r.kernel.org,
 syzkaller-bugs@...glegroups.com, virtualization@...ts.linux.dev,
 xuanzhuo@...ux.alibaba.com
Subject: Re: [syzbot] [virt?] upstream test error: KMSAN: use-after-free in
 vring_map_one_sg

On 10/13/25 10:08 AM, Michael S. Tsirkin wrote:
> On Mon, Oct 13, 2025 at 09:37:29AM +0200, Paolo Abeni wrote:
>> On 10/13/25 9:20 AM, Jason Wang wrote:
>>> On Mon, Oct 13, 2025 at 1:29 PM Jason Wang <jasowang@...hat.com> wrote:
>>>> On Sat, Oct 11, 2025 at 3:40 PM Jason Wang <jasowang@...hat.com> wrote:
>>>>>
>>>>> #syz test
>>>>>
>>>>> On Sat, Oct 11, 2025 at 4:38 AM syzbot
>>>>> <syzbot+ac856b8b866cca41352c@...kaller.appspotmail.com> wrote:
>>>>
>>>> Paolo, it looks like the GSO tunnel features will leave uninitialized
>>>> vnet header field which trigger KMSAN warning.
>>>>
>>>> Please have a look at the patch (which has been tested by syzbot) or
>>>> propose another one.
>>>
>>> Forget the attachment.
>>
>> I have a few questions. The report mentions both UaF and uninit; the
>> patch addresses "just" the uninit access. It's not clear to me if and
>> how the UaF is addressed, and why/if it's related to the uninit access.
> 
> I'd like to understand that, too.

Somewhat related: the syzbot dashboard reports that the issue is no more
reproducible on plain Linus' tree:

https://syzkaller.appspot.com/bug?extid=ac856b8b866cca41352c

"""
* repros no longer work on HEAD.
"""

Possibly there was some external problem?

/P