From: Cong Wang <xiyou.wangcong@gmail.com>
To: syzbot <syzbot+dcc34d54d68ef7d2d53d@syzkaller.appspotmail.com>
Cc: David Miller <davem@davemloft.net>,
Jamal Hadi Salim <jhs@mojatatu.com>,
Jiri Pirko <jiri@resnulli.us>, Jakub Kicinski <kuba@kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Linux Kernel Network Developers <netdev@vger.kernel.org>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: Re: KASAN: invalid-free in tcf_exts_destroy
Date: Tue, 10 Mar 2020 11:33:56 -0700 [thread overview]
Message-ID: <CAM_iQpVgQ+Mc16CVds-ywp6YHEbwbGtJwqoQXBFbrMTOUZS0YQ@mail.gmail.com> (raw)
In-Reply-To: <00000000000034513e05a05cfc23@google.com>
On Sun, Mar 8, 2020 at 12:35 PM syzbot
<syzbot+dcc34d54d68ef7d2d53d@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: c2003765 Merge tag 'io_uring-5.6-2020-03-07' of git://git...
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=10cd2ae3e00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=4527d1e2fb19fd5c
> dashboard link: https://syzkaller.appspot.com/bug?extid=dcc34d54d68ef7d2d53d
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> userspace arch: i386
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1561b01de00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15aad2f9e00000
>
> The bug was bisected to:
>
> commit 599be01ee567b61f4471ee8078870847d0a11e8e
> Author: Cong Wang <xiyou.wangcong@gmail.com>
> Date: Mon Feb 3 05:14:35 2020 +0000
>
> net_sched: fix an OOB access in cls_tcindex
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10a275fde00000
> final crash: https://syzkaller.appspot.com/x/report.txt?x=12a275fde00000
> console output: https://syzkaller.appspot.com/x/log.txt?x=14a275fde00000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+dcc34d54d68ef7d2d53d@syzkaller.appspotmail.com
> Fixes: 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex")
>
> IPVS: ftp: loaded support on port[0] = 21
> ==================================================================
> BUG: KASAN: double-free or invalid-free in tcf_exts_destroy+0x62/0xc0 net/sched/cls_api.c:3002
>
> CPU: 1 PID: 9507 Comm: syz-executor467 Not tainted 5.6.0-rc4-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x188/0x20d lib/dump_stack.c:118
> print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:374
> kasan_report_invalid_free+0x61/0xa0 mm/kasan/report.c:468
> __kasan_slab_free+0x129/0x140 mm/kasan/common.c:455
> __cache_free mm/slab.c:3426 [inline]
> kfree+0x109/0x2b0 mm/slab.c:3757
> tcf_exts_destroy+0x62/0xc0 net/sched/cls_api.c:3002
> tcf_exts_change+0xf4/0x150 net/sched/cls_api.c:3059
> tcindex_set_parms+0xed8/0x1a00 net/sched/cls_tcindex.c:456
Looks like a consequence of "slab-out-of-bounds Write in tcindex_set_parms".
Thanks.
next prev parent reply other threads:[~2020-03-10 18:34 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-08 19:35 KASAN: invalid-free in tcf_exts_destroy syzbot
2020-03-10 18:33 ` Cong Wang [this message]
2020-03-10 20:36 ` Eric Dumazet
2020-03-10 22:02 ` Cong Wang
2020-03-11 1:17 ` Cong Wang
2020-03-11 5:14 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAM_iQpVgQ+Mc16CVds-ywp6YHEbwbGtJwqoQXBFbrMTOUZS0YQ@mail.gmail.com \
--to=xiyou.wangcong@gmail.com \
--cc=davem@davemloft.net \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzbot+dcc34d54d68ef7d2d53d@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.