netdev - Re: BUG: corrupted list in nsim_fib6_rt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANn89i+7cj3y05h9ee1ha1dykbSx6J=7QubBp7NMphQqtpA1iA@mail.gmail.com>
Date: Tue, 11 Feb 2025 13:11:44 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: YAN KANG <kangyan91@...look.com>
Cc: Jakub Kicinski <kuba@...nel.org>, Andrew Lunn <andrew+netdev@...n.ch>, 
	"David S. Miller" <davem@...emloft.net>, Paolo Abeni <pabeni@...hat.com>, 
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, 
	"syzkaller@...glegroups.com" <syzkaller@...glegroups.com>
Subject: Re: BUG: corrupted list in nsim_fib6_rt_destroy

On Tue, Feb 11, 2025 at 1:04 PM YAN KANG <kangyan91@...look.com> wrote:
>
> Dear maintainers,
>
> I found a kernel  bug titiled "BUG: corrupted list in nsim_fib6_rt_destroy " while using modified syzkaller fuzzing tool. I Itested it on the latest Linux upstream version (6.13.0-rc7) .
>
>
> After preliminary analysis, the bug is triggerd in  nsim_fib6_rt_destroy function  drivers/net/netdevsim/fib.c
> when kernel try to delete node from list :  list_del(&fib_rt->list);
> the node has already unlink from the list.

This analysis seems to be AI generated, this is literally rephrasing
the call stack.

>
>
> If you fix this issue, please add the following tag to the commit:
> Reported-by: yan kang <kangyan91@...look.com>
> Reported-by: yue sun <samsun1006219@...il.com
>
>
> I hope it helps.
> Best regards
> yan kang
>
> Kernel crash log  and reproducer are listed below.
>
> ==================================================================
> Syzkaller hit 'BUG: corrupted list in nsim_fib6_rt_destroy' bug.
>
> netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
> list_del corruption. prev->next should be ffff888112b16f28, but was 0000000000000000. (prev=ffff8881083184a8)
> ------------[ cut here ]------------
> kernel BUG at lib/list_debug.c:62!
> Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
> CPU: 0 UID: 0 PID: 9911 Comm: kworker/u8:4 Not tainted 6.13.0-rc1 #5

This is not 6.13.0-rc7