lkml.org 
[lkml]   [2017]   [Nov]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: KASAN: use-after-free Read in aead_recvmsg
On Mon, Nov 27, 2017 at 11:02:08PM +0100, Stephan Müller wrote:
> Am Montag, 27. November 2017, 19:56:46 CET schrieb syzbot:
>
> Hi,
>
> > Hello,
> >
> > syzkaller hit the following crash on
> > 6fc478f80f6809cc4b1a4230f47a62d3b7378dc0
> > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
> > compiler: gcc (GCC) 7.1.1 20170620
> > .config is attached
> > Raw console output is attached.
> > C reproducer is attached
> > syzkaller reproducer is attached. See https://goo.gl/kgGztJ
> > for information about syzkaller reproducers
>
> Could you please re-perform the test applying the patch https://
> git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git/commit/?
> id=8e1fa89aa8bc2870009b4486644e4a58f2e2a4f5 ?
>
> At least I am not able to reproduce that issue using the repro.c with the
> patch applied.
>

No, that doesn't help. I tested v4.15-rc1 with all the extra commits from
crypto-2.6.git/master applied:

crypto: algif_aead - skip SGL entries with NULL page
crypto: af_alg - remove locking in async callback
crypto: skcipher - Fix skcipher_walk_aead_common

Did you use the .config the bot provided? It's possible the bug is only
noticable with KASAN enabled.

Eric

\
 
 \ /
  Last update: 2017-11-27 23:43    [W:0.053 / U:18.452 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site