linux-kernel - Re: [syzbot] [virt?] upstream test error: KMSAN: use-after-free in vring_map_one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACGkMEucE6c=50egk=Hryie2fxZaEjFt22mLX20+T=68rFLNnw@mail.gmail.com>
Date: Tue, 14 Oct 2025 10:41:15 +0800
From: Jason Wang <jasowang@...hat.com>
To: Paolo Abeni <pabeni@...hat.com>
Cc: "Michael S. Tsirkin" <mst@...hat.com>, 
	syzbot <syzbot+ac856b8b866cca41352c@...kaller.appspotmail.com>, eperezma@...hat.com, 
	linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com, 
	virtualization@...ts.linux.dev, xuanzhuo@...ux.alibaba.com
Subject: Re: [syzbot] [virt?] upstream test error: KMSAN: use-after-free in vring_map_one_sg

On Mon, Oct 13, 2025 at 4:17 PM Paolo Abeni <pabeni@...hat.com> wrote:
>
> On 10/13/25 10:08 AM, Michael S. Tsirkin wrote:
> > On Mon, Oct 13, 2025 at 09:37:29AM +0200, Paolo Abeni wrote:
> >> On 10/13/25 9:20 AM, Jason Wang wrote:
> >>> On Mon, Oct 13, 2025 at 1:29 PM Jason Wang <jasowang@...hat.com> wrote:
> >>>> On Sat, Oct 11, 2025 at 3:40 PM Jason Wang <jasowang@...hat.com> wrote:
> >>>>>
> >>>>> #syz test
> >>>>>
> >>>>> On Sat, Oct 11, 2025 at 4:38 AM syzbot
> >>>>> <syzbot+ac856b8b866cca41352c@...kaller.appspotmail.com> wrote:
> >>>>
> >>>> Paolo, it looks like the GSO tunnel features will leave uninitialized
> >>>> vnet header field which trigger KMSAN warning.
> >>>>
> >>>> Please have a look at the patch (which has been tested by syzbot) or
> >>>> propose another one.
> >>>
> >>> Forget the attachment.
> >>
> >> I have a few questions. The report mentions both UaF and uninit; the
> >> patch addresses "just" the uninit access. It's not clear to me if and
> >> how the UaF is addressed, and why/if it's related to the uninit access.
> >
> > I'd like to understand that, too.
>
> Somewhat related: the syzbot dashboard reports that the issue is no more
> reproducible on plain Linus' tree:
>
> https://syzkaller.appspot.com/bug?extid=ac856b8b866cca41352c

Interesting.

>
> """
> * repros no longer work on HEAD.
> """
>
> Possibly there was some external problem?

I think at least we need to make sure no information as we did in
virtio_net_hdr_from_skb():

static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb,
                                          struct virtio_net_hdr *hdr,
                                          bool little_endian,
                                          bool has_data_valid,
                                          int vlan_hlen)
{
        memset(hdr, 0, sizeof(*hdr));   /* no info leak */

Thanks

>
> /P
>
>