From: Dmitry Vyukov <dvyukov@google.com>
To: Grant Grundler <grundler@chromium.org>,
syzkaller <syzkaller@googlegroups.com>
Cc: Greg KH <gregkh@linuxfoundation.org>,
syzbot <syzbot+a66a7c2e996797bb4acb@syzkaller.appspotmail.com>,
David Miller <davem@davemloft.net>,
festevam@gmail.com, Hayes Wang <hayeswang@realtek.com>,
Johan Hedberg <johan.hedberg@gmail.com>,
kernel@pengutronix.de,
Linux ARM <linux-arm-kernel@lists.infradead.org>,
linux-bluetooth <linux-bluetooth@vger.kernel.org>,
dl-linux-imx <linux-imx@nxp.com>,
LKML <linux-kernel@vger.kernel.org>,
USB list <linux-usb@vger.kernel.org>,
Marcel Holtmann <marcel@holtmann.org>,
nishadkamdar@gmail.com, peter.chen@nxp.com,
Prashant Malani <pmalani@chromium.org>,
Sascha Hauer <s.hauer@pengutronix.de>,
Shawn Guo <shawnguo@kernel.org>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: Re: KASAN: use-after-free Read in skb_release_data (2)
Date: Wed, 1 Apr 2020 11:12:55 +0200 [thread overview]
Message-ID: <CACT4Y+Yk_93iScH6F0hhR2yo+pCx_0J32TaTC-_QfXy69pauMA@mail.gmail.com> (raw)
In-Reply-To: <CANEJEGuhZChGXFzbwaEwArM4UKjUxZo=WNbREPH3887xtu62Nw@mail.gmail.com>
On Tue, Mar 31, 2020 at 7:44 PM Grant Grundler <grundler@chromium.org> wrote:
>
> On Tue, Mar 31, 2020 at 10:41 AM Greg KH <gregkh@linuxfoundation.org> wrote:
> >
> > On Tue, Mar 31, 2020 at 10:36:01AM -0700, syzbot wrote:
> > > syzbot suspects this bug was fixed by commit:
> > >
> > > commit d9958306d4be14f4c7466242b38ed3893a7b1386
> > > Author: Nishad Kamdar <nishadkamdar@gmail.com>
> > > Date: Sun Mar 15 10:55:07 2020 +0000
> > >
> > > USB: chipidea: Use the correct style for SPDX License Identifier
> > >
> > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16d4940be00000
> > > start commit: 63623fd4 Merge tag 'for-linus' of git://git.kernel.org/pub..
> > > git tree: upstream
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=5d2e033af114153f
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=a66a7c2e996797bb4acb
> > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13c25a81e00000
> > >
> > > If the result looks correct, please mark the bug fixed by replying with:
> > >
> > > #syz fix: USB: chipidea: Use the correct style for SPDX License Identifier
> >
> > I really doubt a comment change fixed a syzbot bug :)
>
> Just as I don't believe the bug was caused by pmalani's patch to r8152.
>
> syzbot is just having trouble automatically bisecting/tracking this
> bug since it appears only intermittently.
Checking if vmlinux changes after applying the patch looked like a
smart and simple way to detect all of:
- Comment-only change
- Documentation-only change
- Change to a non-current arch
- Changed to non-enabled configs
- Changes to tests only
But it's not working in reality, there is some bug in kernel or compiler:
https://github.com/google/syzkaller/issues/1271#issuecomment-559093018
You may see in this bisection log as well:
culprit signature:
85ed07d5a8769c26fa0d170475624841e367ea0d08ea79f55ca450a9e97429a0
parent signature:
2244116b3fcae3bb24003990bcd2b06a03861effee2d94675e527446c3da078f
So this commit somehow does very realistically affect the kernel
binary. So far nobody figured out why...
Before you ask, syzkaller filters out debug info, etc:
https://github.com/google/syzkaller/blob/master/pkg/build/linux.go#L168-L178
prev parent reply other threads:[~2020-04-01 9:13 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <000000000000da6059059fcfdcf9@google.com>
2020-03-31 17:36 ` KASAN: use-after-free Read in skb_release_data (2) syzbot
2020-03-31 17:41 ` Greg KH
2020-03-31 17:44 ` Grant Grundler
2020-04-01 9:12 ` Dmitry Vyukov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CACT4Y+Yk_93iScH6F0hhR2yo+pCx_0J32TaTC-_QfXy69pauMA@mail.gmail.com \
--to=dvyukov@google.com \
--cc=davem@davemloft.net \
--cc=festevam@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=grundler@chromium.org \
--cc=hayeswang@realtek.com \
--cc=johan.hedberg@gmail.com \
--cc=kernel@pengutronix.de \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-imx@nxp.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=nishadkamdar@gmail.com \
--cc=peter.chen@nxp.com \
--cc=pmalani@chromium.org \
--cc=s.hauer@pengutronix.de \
--cc=shawnguo@kernel.org \
--cc=syzbot+a66a7c2e996797bb4acb@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).