Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:8 as permitted sender) client-ip=2620:137:e000::3:8;
MIME-Version: 1.0
References: <000000000000347a250608e8a4d1@google.com>
In-Reply-To: <000000000000347a250608e8a4d1@google.com>
From:   Jann Horn <jannh@google.com>
Date:   Wed, 22 Nov 2023 22:46:55 +0100
Message-ID: <CAG48ez1_kkR6-tSkmzBu0Z-Jex0MoKQ5OJSQaK3mcHc-aT+G+w@mail.gmail.com>
Subject: Re: [syzbot] [net?] general protection fault in tls_merge_open_record
To:     syzbot <syzbot+40d43509a099ea756317@syzkaller.appspotmail.com>
Cc:     borisp@nvidia.com, davem@davemloft.net, edumazet@google.com,
        john.fastabend@gmail.com, kuba@kernel.org,
        linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
        pabeni@redhat.com, syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, Oct 30, 2023 at 6:52=E2=80=AFAM syzbot
<syzbot+40d43509a099ea756317@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    66f1e1ea3548 Add linux-next specific files for 20231027
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=3D11b621fd68000=
0
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3D2911330219149=
de4
> dashboard link: https://syzkaller.appspot.com/bug?extid=3D40d43509a099ea7=
56317
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for D=
ebian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=3D1552332d680=
000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/e0bf12f215f2/dis=
k-66f1e1ea.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/5e854ca6e2c3/vmlinu=
x-66f1e1ea.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/25e8c098714e/b=
zImage-66f1e1ea.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the comm=
it:
> Reported-by: syzbot+40d43509a099ea756317@syzkaller.appspotmail.com
>
> general protection fault, probably for non-canonical address 0xdffffc0000=
000001: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> CPU: 1 PID: 12569 Comm: syz-executor.0 Not tainted 6.6.0-rc7-next-2023102=
7-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS G=
oogle 10/09/2023
> RIP: 0010:_compound_head include/linux/page-flags.h:247 [inline]
> RIP: 0010:put_page include/linux/mm.h:1544 [inline]
> RIP: 0010:tls_merge_open_record+0x4b9/0x7f0 net/tls/tls_sw.c:669

I've posted an analysis and suggested fix for the issue at
<https://lore.kernel.org/lkml/20231122214447.675768-1-jannh@google.com/>.