netdev - Re: [net] tipc: fix use-after-free Read in tipc_named

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 17 Jun 2022 10:40:14 +0000
From:   patchwork-bot+netdevbpf@...nel.org
To:     Hoang Le <hoang.h.le@...tech.com.au>
Cc:     jmaloy@...hat.com, maloy@...jonn.com, ying.xue@...driver.com,
        tung.q.nguyen@...tech.com.au, kuba@...nel.org, pabeni@...hat.com,
        edumazet@...gle.com, tipc-discussion@...ts.sourceforge.net,
        netdev@...r.kernel.org,
        syzbot+47af19f3307fc9c5c82e@...kaller.appspotmail.com
Subject: Re: [net] tipc: fix use-after-free Read in tipc_named_reinit

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <davem@...emloft.net>:

On Fri, 17 Jun 2022 08:45:51 +0700 you wrote:
> syzbot found the following issue on:
> ==================================================================
> BUG: KASAN: use-after-free in tipc_named_reinit+0x94f/0x9b0
> net/tipc/name_distr.c:413
> Read of size 8 at addr ffff88805299a000 by task kworker/1:9/23764
> 
> CPU: 1 PID: 23764 Comm: kworker/1:9 Not tainted
> 5.18.0-rc4-syzkaller-00878-g17d49e6e8012 #0
> Hardware name: Google Compute Engine/Google Compute Engine,
> BIOS Google 01/01/2011
> Workqueue: events tipc_net_finalize_work
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
>  print_address_description.constprop.0.cold+0xeb/0x495
> mm/kasan/report.c:313
>  print_report mm/kasan/report.c:429 [inline]
>  kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
>  tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413
>  tipc_net_finalize+0x234/0x3d0 net/tipc/net.c:138
>  process_one_work+0x996/0x1610 kernel/workqueue.c:2289
>  worker_thread+0x665/0x1080 kernel/workqueue.c:2436
>  kthread+0x2e9/0x3a0 kernel/kthread.c:376
>  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
>  </TASK>
> [...]
> ==================================================================
> 
> [...]

Here is the summary with links:
  - [net] tipc: fix use-after-free Read in tipc_named_reinit
    https://git.kernel.org/netdev/net/c/911600bf5a5e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html