Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
In-Reply-To: <26c434ee-0a0a-fbba-282c-dabddfac652e@iogearbox.net>
References: <000000000000402477056e89f067@google.com> <26c434ee-0a0a-fbba-282c-dabddfac652e@iogearbox.net>
From:   Dmitry Vyukov <dvyukov@google.com>
Date:   Thu, 14 Jun 2018 09:37:12 +0200
Message-ID: <CACT4Y+ZhMnjMd0E7V7Tv7HwFKqoeP078n-Q=ZScGMp3tLkrqmA@mail.gmail.com>
Subject: Re: KASAN: slab-out-of-bounds Read in bpf_skb_vlan_push
To:     Daniel Borkmann <daniel@iogearbox.net>
Cc:     syzbot <syzbot+76de61614cb1abdd73fc@syzkaller.appspotmail.com>,
        Alexei Starovoitov <ast@kernel.org>,
        David Miller <davem@davemloft.net>,
        LKML <linux-kernel@vger.kernel.org>,
        netdev <netdev@vger.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Wed, Jun 13, 2018 at 8:15 PM, Daniel Borkmann <daniel@iogearbox.net> wrote:
> On 06/13/2018 08:13 PM, syzbot wrote:
>>> On 06/13/2018 06:17 PM, syzbot wrote:
>>>> Hello,
>>
>>>> syzbot found the following crash on:
>>
>>>> HEAD commit:    75d4e704fa8d netdev-FAQ: clarify DaveM's position for stab..
>>>> git tree:       bpf-next
>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=1754783f800000
>>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=a601a80fec461d44
>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=76de61614cb1abdd73fc
>>>> compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
>>>> syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=12c1e1bf800000
>>
>>>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>>>> Reported-by: syzbot+76de61614cb1abdd73fc@syzkaller.appspotmail.com
>>
>>>> IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
>>>> IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
>>>> 8021q: adding VLAN 0 to HW filter on device team0
>>>> 8021q: adding VLAN 0 to HW filter on device team0
>>>> ==================================================================
>>>> BUG: KASAN: slab-out-of-bounds in skb_at_tc_ingress include/net/sch_generic.h:535 [inline]
>>>> BUG: KASAN: slab-out-of-bounds in bpf_push_mac_rcsum net/core/filter.c:1625 [inline]
>>>> BUG: KASAN: slab-out-of-bounds in ____bpf_skb_vlan_push net/core/filter.c:2446 [inline]
>>>> BUG: KASAN: slab-out-of-bounds in bpf_skb_vlan_push+0x6b7/0x720 net/core/filter.c:2437
>>>> Read of size 5 at addr ffff8801b77347d0 by task syz-executor6/6529
>>
>>> Should be fixed already by:
>>
>>>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58990d1ff3f7896ee341030e9a7c2e4002570683
>>
>>
>>> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>>
>> want 2 args (repo, branch), got 1
>
> Fair enough ... assumed default would have been master. ;-)

There is an issue with making defaults. Some email clients reflow
emails and split lines and git repo address can be lengthy and trigger
such reflow. To work around this syzbot currently looks for 2 "tokens"
after syz test, not necessary on the same line. The default for branch
will cause ambiguity in parsing: is it only repo without branch, or is
it repo with branch on the next line? Engineering hits reality...

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master