Messages in this thread Patch in this message | | | From | Hillf Danton <> | Subject | Re: [syzbot] [net?] KASAN: use-after-free Read in __skb_flow_dissect (3) | Date | Thu, 18 Jan 2024 21:17:50 +0800 |
| |
On Mon, 01 Jan 2024 09:18:16 -0800 > syzbot found the following issue on: > > HEAD commit: f5837722ffec Merge tag 'mm-hotfixes-stable-2023-12-27-15-0.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=122dfc65e80000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
--- x/net/core/flow_dissector.c +++ y/net/core/flow_dissector.c @@ -1163,10 +1163,8 @@ proto_again: switch (proto) { case htons(ETH_P_IP): { - const struct iphdr *iph; - struct iphdr _iph; + const struct iphdr *iph = (struct iphdr *) skb_network_header(skb); - iph = __skb_header_pointer(skb, nhoff, sizeof(_iph), data, hlen, &_iph); if (!iph || iph->ihl < 5) { fdret = FLOW_DISSECT_RET_OUT_BAD; break; --
| |