lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <7e866a56-23a1-a528-63cb-8f6da536df74@gmail.com> Date: Thu, 30 Aug 2018 16:05:55 -0700 From: John Fastabend <john.fastabend@...il.com> To: Dmitry Vyukov <dvyukov@...gle.com>, syzbot <syzbot+a58b558e3e62d0604e5c@...kaller.appspotmail.com>, netdev <netdev@...r.kernel.org>, Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, "H. Peter Anvin" <hpa@...or.com>, Kate Stewart <kstewart@...uxfoundation.org>, LKML <linux-kernel@...r.kernel.org>, Andy Lutomirski <luto@...nel.org>, Ingo Molnar <mingo@...hat.com>, nstange@...e.de, syzkaller-bugs <syzkaller-bugs@...glegroups.com>, Thomas Gleixner <tglx@...utronix.de>, the arch/x86 maintainers <x86@...nel.org> Subject: Re: WARNING in handle_irq (3) On 08/30/2018 08:39 AM, Dmitry Vyukov wrote: > On Thu, Aug 30, 2018 at 8:31 AM, syzbot > <syzbot+a58b558e3e62d0604e5c@...kaller.appspotmail.com> wrote: >> Hello, >> >> syzbot found the following crash on: >> >> HEAD commit: 58c3f14f86c9 Merge tag 'riscv-for-linus-4.19-rc2' of git:/.. >> git tree: upstream >> console output: https://syzkaller.appspot.com/x/log.txt?x=10be176a400000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=531a917630d2a492 >> dashboard link: https://syzkaller.appspot.com/bug?extid=a58b558e3e62d0604e5c >> compiler: gcc (GCC) 8.0.1 20180413 (experimental) >> >> Unfortunately, I don't have any reproducer for this crash yet. > > +bpf maintainers > > Looks suspiciously similar to: > https://groups.google.com/d/msg/syzkaller-bugs/4v7MtbIT1hY/A87hInzyAwAJ > > Note this commit seems to already have "bpf, sockmap: fix > sock_hash_alloc and reject zero-sized keys ". > > Tentative reproducer from the log is: > > 14:08:59 executing program 5: > socketpair(0x20000, 0x0, 0x0, &(0x7f0000000140)) > r0 = socket$inet6_tcp(0xa, 0x1, 0x0) > r1 = socket$inet6_tcp(0xa, 0x1, 0x0) > bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) > listen(r1, 0x0) > sendto$inet6(r0, &(0x7f0000000140), 0x2d6, 0x20000004, > &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) > setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) > r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x4, 0x4, 0x70}, 0x2c) > bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r2, &(0x7f0000000000), > &(0x7f0000000140)}, 0x20) > > Which does not create a 0-key map. > > Hi Dmitry, Testing a fix for this now, we have an error path that can call module_put and/or null the ulp ops erroneously. Should have something out later tonight or worst case early tomorrow. Thanks for the snippet. Thanks, John
Powered by blists - more mailing lists