lkml.org 
[lkml]   [2018]   [May]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: KASAN: out-of-bounds Read in ip6_xmit
On Tue, May 08, 2018 at 09:45:25PM -0700, Eric Biggers wrote:
> On Sun, Jan 28, 2018 at 11:24:01AM -0800, syzbot wrote:
> > Hello,
> >
> > syzbot hit the following crash on net-next commit
> > 6bb46bc57c8e9ce947cc605e555b7204b44d2b10 (Fri Jan 26 16:00:23 2018 +0000)
> > Merge branch 'cxgb4-fix-dump-collection-when-firmware-crashed'
> >
> > Unfortunately, I don't have any reproducer for this crash yet.
> > Raw console output is attached.
> > compiler: gcc (GCC) 7.1.1 20170620
> > .config is attached.
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+c8e66da874feb11aaca6@syzkaller.appspotmail.com
> > It will help syzbot understand when the bug is fixed. See footer for
> > details.
> > If you forward the report, please keep this part and the footer.
> >
> > ==================================================================
> > BUG: KASAN: out-of-bounds in ip6_dst_idev include/net/ip6_fib.h:192 [inline]
> > BUG: KASAN: out-of-bounds in ip6_xmit+0x1f76/0x2260
> > net/ipv6/ip6_output.c:264
> > Read of size 8 at addr ffff8801bcc8cc18 by task syz-executor2/11459
> >
> > CPU: 0 PID: 11459 Comm: syz-executor2 Not tainted 4.15.0-rc9+ #212
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > Google 01/01/2011
> > Call Trace:
> > __dump_stack lib/dump_stack.c:17 [inline]
> > dump_stack+0x194/0x257 lib/dump_stack.c:53
> > print_address_description+0x73/0x250 mm/kasan/report.c:252
> > kasan_report_error mm/kasan/report.c:351 [inline]
> > kasan_report+0x25b/0x340 mm/kasan/report.c:409
> > __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
> > ip6_dst_idev include/net/ip6_fib.h:192 [inline]
> > ip6_xmit+0x1f76/0x2260 net/ipv6/ip6_output.c:264
> > inet6_csk_xmit+0x2fc/0x580 net/ipv6/inet6_connection_sock.c:139
> > l2tp_xmit_core net/l2tp/l2tp_core.c:1096 [inline]
> > l2tp_xmit_skb+0x105f/0x1410 net/l2tp/l2tp_core.c:1191
> > pppol2tp_sendmsg+0x470/0x670 net/l2tp/l2tp_ppp.c:341
> > sock_sendmsg_nosec net/socket.c:630 [inline]
> > sock_sendmsg+0xca/0x110 net/socket.c:640
> > ___sys_sendmsg+0x767/0x8b0 net/socket.c:2046
> > __sys_sendmsg+0xe5/0x210 net/socket.c:2080
> > SYSC_sendmsg net/socket.c:2091 [inline]
> > SyS_sendmsg+0x2d/0x50 net/socket.c:2087
> > entry_SYSCALL_64_fastpath+0x29/0xa0
>
> No reproducer and last occurred 58 days ago (on commit f44b1886a5f876c8).
> Probably was fixed by commit b954f94023dcc61:
>
Indeed, this commit certainly applies to this report too. Thanks a lot
for looking into this.

\
 
 \ /
  Last update: 2018-05-15 15:06    [W:0.092 / U:3.092 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site