linux-kernel - Re: [syzbot] [virt?] upstream test error: KMSAN: use-after-free in vring_map_one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACGkMEs3iV8kpEmZJzch3jUxZqV5Ff4k51SR+LGKW9sg2WAZhQ@mail.gmail.com>
Date: Tue, 14 Oct 2025 10:38:25 +0800
From: Jason Wang <jasowang@...hat.com>
To: "Michael S. Tsirkin" <mst@...hat.com>
Cc: Paolo Abeni <pabeni@...hat.com>, 
	syzbot <syzbot+ac856b8b866cca41352c@...kaller.appspotmail.com>, eperezma@...hat.com, 
	linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com, 
	virtualization@...ts.linux.dev, xuanzhuo@...ux.alibaba.com
Subject: Re: [syzbot] [virt?] upstream test error: KMSAN: use-after-free in vring_map_one_sg

On Mon, Oct 13, 2025 at 4:08 PM Michael S. Tsirkin <mst@...hat.com> wrote:
>
> On Mon, Oct 13, 2025 at 09:37:29AM +0200, Paolo Abeni wrote:
> > On 10/13/25 9:20 AM, Jason Wang wrote:
> > > On Mon, Oct 13, 2025 at 1:29 PM Jason Wang <jasowang@...hat.com> wrote:
> > >> On Sat, Oct 11, 2025 at 3:40 PM Jason Wang <jasowang@...hat.com> wrote:
> > >>>
> > >>> #syz test
> > >>>
> > >>> On Sat, Oct 11, 2025 at 4:38 AM syzbot
> > >>> <syzbot+ac856b8b866cca41352c@...kaller.appspotmail.com> wrote:
> > >>
> > >> Paolo, it looks like the GSO tunnel features will leave uninitialized
> > >> vnet header field which trigger KMSAN warning.
> > >>
> > >> Please have a look at the patch (which has been tested by syzbot) or
> > >> propose another one.
> > >
> > > Forget the attachment.
> >
> > I have a few questions. The report mentions both UaF and uninit; the
> > patch addresses "just" the uninit access. It's not clear to me if and
> > how the UaF is addressed, and why/if it's related to the uninit access.
>
>
> I'd like to understand that, too.
>
> > Do you know better?

Unfortunately, I didn't spot any UAF.

> >
> > It looks like the uninit root cause is on "the other side"? i.e. the
> > device not initializing properly the header.

The trace is in the TX path, so it's not the device side.

> > Would unconditionally
> > clearing the hash info implicitly disable such feature?

The feature is not used on the TX side in virtio-net. On the RX side
(e.g TUN) it has not been implemented yet.

> >
> > The syzbot dashboard mentions a (no more available) reproducer. Do you
> > have it cached somewhere?

I don't.

Thanks

> >
> > Thanks,
> >
> > Paolo
>