netdev - Re: KASAN: use-after-free Read in bitmap_ip_ext

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 19 Jan 2020 12:21:00 -0800
From:   syzbot <syzbot+b554d01b6c7870b17da2@...kaller.appspotmail.com>
To:     a@...table.cc, b.a.t.m.a.n@...ts.open-mesh.org,
        bridge@...ts.linux-foundation.org, coreteam@...filter.org,
        davem@...emloft.net, florent.fourcot@...irst.fr, fw@...len.de,
        jeremy@...zel.net, johannes.berg@...el.com, kadlec@...filter.org,
        linux-kernel@...r.kernel.org, mareklindner@...mailbox.ch,
        netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
        nikolay@...ulusnetworks.com, pablo@...filter.org,
        roopa@...ulusnetworks.com, sw@...onwunderlich.de,
        syzkaller-bugs@...glegroups.com
Subject: Re: KASAN: use-after-free Read in bitmap_ip_ext_cleanup

syzbot has bisected this bug to:

commit 3d26eb8ad1e9b906433903ce05f775cf038e747f
Author: Nikolay Aleksandrov <nikolay@...ulusnetworks.com>
Date:   Tue Jul 2 12:00:20 2019 +0000

    net: bridge: don't cache ether dest pointer on input

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=17bb1cc9e00000
start commit:   9aaa2949 Merge branch '1GbE' of git://git.kernel.org/pub/s..
git tree:       net-next
final crash:    https://syzkaller.appspot.com/x/report.txt?x=147b1cc9e00000
console output: https://syzkaller.appspot.com/x/log.txt?x=107b1cc9e00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=66d8660c57ff3c98
dashboard link: https://syzkaller.appspot.com/bug?extid=b554d01b6c7870b17da2
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15db12a5e00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15316faee00000

Reported-by: syzbot+b554d01b6c7870b17da2@...kaller.appspotmail.com
Fixes: 3d26eb8ad1e9 ("net: bridge: don't cache ether dest pointer on input")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection