Messages in this thread | | | From | Dmitry Vyukov <> | Date | Mon, 4 Jun 2018 07:36:57 +0200 | Subject | Re: KASAN: slab-out-of-bounds Read in bpf_csum_update |
| |
On Mon, Jun 4, 2018 at 1:36 AM, syzbot <syzbot+efae31b384d5badbd620@syzkaller.appspotmail.com> wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit: 0512e0134582 Merge tag 'xfs-4.17-fixes-3' of git://git.ker.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=17eb2d7b800000 > kernel config: https://syzkaller.appspot.com/x/.config?x=968b0b23c7854c0b > dashboard link: https://syzkaller.appspot.com/bug?extid=efae31b384d5badbd620 > compiler: gcc (GCC) 8.0.1 20180413 (experimental) > syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=162c6def800000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14fe3db7800000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+efae31b384d5badbd620@syzkaller.appspotmail.com > > random: sshd: uninitialized urandom read (32 bytes read) > random: sshd: uninitialized urandom read (32 bytes read) > random: sshd: uninitialized urandom read (32 bytes read) > random: sshd: uninitialized urandom read (32 bytes read) > ================================================================== > BUG: KASAN: slab-out-of-bounds in ____bpf_csum_update net/core/filter.c:1679 > [inline] > BUG: KASAN: slab-out-of-bounds in bpf_csum_update+0xb4/0xc0 > net/core/filter.c:1673 > Read of size 1 at addr ffff8801d9235b50 by task syz-executor507/4513 > > CPU: 0 PID: 4513 Comm: syz-executor507 Not tainted 4.17.0-rc7+ #78 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x1b9/0x294 lib/dump_stack.c:113 > print_address_description+0x6c/0x20b mm/kasan/report.c:256 > kasan_report_error mm/kasan/report.c:354 [inline] > kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 > __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430 > ____bpf_csum_update net/core/filter.c:1679 [inline] > bpf_csum_update+0xb4/0xc0 net/core/filter.c:1673
/\/\/\/\/\
Are there any known bugs with unwind through bpf functions?
> Allocated by task 0: > (stack is not available) > > Freed by task 0: > (stack is not available) > > The buggy address belongs to the object at ffff8801d9235a40 > which belongs to the cache skbuff_head_cache of size 232 > The buggy address is located 40 bytes to the right of > 232-byte region [ffff8801d9235a40, ffff8801d9235b28) > The buggy address belongs to the page: > page:ffffea0007648d40 count:1 mapcount:0 mapping:ffff8801d9235040 index:0x0 > flags: 0x2fffc0000000100(slab) > raw: 02fffc0000000100 ffff8801d9235040 0000000000000000 000000010000000c > raw: ffffea00074360a0 ffff8801d944d848 ffff8801d9bdd6c0 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffff8801d9235a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff8801d9235a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >> >> ffff8801d9235b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ^ > ffff8801d9235b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff8801d9235c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ================================================================== > > > --- > This bug is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkaller@googlegroups.com. > > syzbot will keep track of this bug report. See: > https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with > syzbot. > syzbot can test patches for this bug, for details see: > https://goo.gl/tpsmEJ#testing-patches > > -- > You received this message because you are subscribed to the Google Groups > "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to syzkaller-bugs+unsubscribe@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/syzkaller-bugs/000000000000b2a7ea056dc54779%40google.com. > For more options, visit https://groups.google.com/d/optout.
| |