Received: by 2002:ac0:a5b6:0:0:0:0:0 with SMTP id m51-v6csp642872imm; Fri, 8 Jun 2018 02:54:09 -0700 (PDT) X-Google-Smtp-Source: ADUXVKLW19bAVeW+pLeG7WKnQKt0CLg5V2+/D9+tRk3ePGgoIfFM6NaevpsI7BzRYiGRA0rIz0MM X-Received: by 2002:a63:a00a:: with SMTP id r10-v6mr4736925pge.222.1528451649894; Fri, 08 Jun 2018 02:54:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1528451649; cv=none; d=google.com; s=arc-20160816; b=I08gFDsEHxDx4VWUIcNuMqaCDuKD8OSew7aBAW57B/JA7VRQGrpgTFmJO2troAMFud C9p0GKFCgj5vNzgOBOipzEyes4NqAD6I+mqr2v+FE7x6PvvsP2BY/9CCEQCS5RMbo1GW v9Tt4zzT+uWJXrKy3wckQpBdjIuJgY9C8F4LCE9eQDZ7f5K5tQVUkzeWAqw7ilZX/Gxg YX0OeA5ZffMgwv3eMMhAMlumsEZ61evqQ9sGcX99155pvd073WO5JhGyOyV0SvSiDydx baq8xP5F5FamJQ5Rt3kd4WK41kDIGg0rcU97XIZhi+fFnQdXDG5FvGdA8o59RwMoh1aH Rj2A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:from:references:to:subject:arc-authentication-results; bh=dZ7f6gofzSza4yzkY8VA5MzFupLh/Dy2siJHCfP9zTQ=; b=dJSktbQpgoI9me1k8FactX0Arwx1GanmbWA5RPMspJrxtSesU2I2+1lzhdJ27AZC24 o9P/fUlAM8gW28kLsUs4t9ZIneCyOC3iZ2eERu7L5LO9n+x/Oukt+UZ3KuUy/qID81rE NdgrozMNyYwqcz5Iq0grqz6O4acVBevxzlm0NA3KTH+NjoK5jEJNPINsp8eTA+MZBCnK imPgUVwpE0cWSkxh77t1wa8M3cSbp38q8QPV+CTGsTd2ZzU4S//J5pi2PtbLQOKhm2ND xEGH5e2dKZKb08DREsmVICzWz9D4tXSNJ4OUXTPnvJpyL6qXtQ31jzpnaizfA5IC834t +rsA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id q79-v6si5612038pfk.268.2018.06.08.02.53.55; Fri, 08 Jun 2018 02:54:09 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752805AbeFHJw7 (ORCPT + 99 others); Fri, 8 Jun 2018 05:52:59 -0400 Received: from www62.your-server.de ([213.133.104.62]:39332 "EHLO www62.your-server.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751186AbeFHJw5 (ORCPT ); Fri, 8 Jun 2018 05:52:57 -0400 Received: from [178.197.248.12] (helo=linux.home) by www62.your-server.de with esmtpsa (TLSv1.2:DHE-RSA-AES256-SHA:256) (Exim 4.85_2) (envelope-from ) id 1fRE4k-0008S5-Nq; Fri, 08 Jun 2018 11:52:54 +0200 Subject: Re: KASAN: use-after-free Read in bpf_csum_update To: syzbot , ast@kernel.org, davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com References: <000000000000bec587056dc547ba@google.com> From: Daniel Borkmann Message-ID: <732ecdd6-135d-7a3e-6c06-fb098c65d76f@iogearbox.net> Date: Fri, 8 Jun 2018 11:52:54 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <000000000000bec587056dc547ba@google.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Authenticated-Sender: daniel@iogearbox.net X-Virus-Scanned: Clear (ClamAV 0.99.3/24643/Fri Jun 8 06:37:57 2018) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 06/04/2018 01:36 AM, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit:    bcece5dc40b9 bpf: Change bpf_fib_lookup to return -EAFNOSU.. > git tree:       bpf-next > console output: https://syzkaller.appspot.com/x/log.txt?x=161e2c6f800000 > kernel config:  https://syzkaller.appspot.com/x/.config?x=e4078980b886800c > dashboard link: https://syzkaller.appspot.com/bug?extid=3d0b2441dbb71751615e > compiler:       gcc (GCC) 8.0.1 20180413 (experimental) > syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=17cb5adf800000 > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17ebf19f800000 #syz fix: bpf: reject passing modified ctx to helper functions