Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Fri, 3 Sep 2021 21:33:20 -0400
From:   Daniel Jordan <daniel.m.jordan@oracle.com>
To:     syzbot <syzbot+b187b77c8474f9648fae@syzkaller.appspotmail.com>
Cc:     akpm@linux-foundation.org, davem@davemloft.net,
        herbert@gondor.apana.org.au, josh@joshtriplett.org,
        linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com,
        torvalds@linux-foundation.org
Subject: Re: [syzbot] KASAN: use-after-free Read in __crypto_xor
Message-ID: <20210904013320.7nrsz4ybh75vkjij@oracle.com>
References: <000000000000b503bc05cb0ba623@google.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <000000000000b503bc05cb0ba623@google.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?tY+dsqjEf8YF2VQw/yY4S1I+/3tOb9nGESiqQC1RZk02yqLBS6WM7EBzuJeN?=
 =?us-ascii?Q?pK5kJBxgV59rScI/IzoowgOkxKRgrrxtMFb7FGAQGvtJk36NhmIvOUNmBJS4?=
 =?us-ascii?Q?KjDVVvaW/XkcF8khWeW3fePtVwhpHFJXPVlxUUJQ2PFbbBstQROAdgX3MtnM?=
 =?us-ascii?Q?4xqmth/GRAeyYNQfQXfNKEnwnKET3s++j08eusTb9zR9Zw9AhsSChLnLeHiP?=
 =?us-ascii?Q?OXcrbAbtvNaPmUkTVHO1NnfeLqyt/4eELAM44bMOl9RqiaHzI0vb4IiWyWZk?=
 =?us-ascii?Q?F/Y0RCqgUINuUCb5iilT/z+X3fBx4uzvtSXM2M1UdM4Ylznt2Cw0kA3Zs7PD?=
 =?us-ascii?Q?xgjprCG0pL2Zr79oXCcjCGn23c3mLxwELlmyLtG+rS+fMu570LcGs+zS2gq4?=
 =?us-ascii?Q?jkGMWoi5RWJxpQeH+dkqBjIZmQFOTKh7ilQqP7ex2IbKW3lS+eN9hZ7I44qC?=
 =?us-ascii?Q?SpzvjhrwHpWhfMRO2apBZwzPsF7CAhHsQoeEonyG0jluYymShDBV/jelwV4d?=
 =?us-ascii?Q?NXuJzAqXG0iw+z5JG5jJymv0PTq4dL3DgfqnZAebl1D76XEPruQ4+wuvttW1?=
 =?us-ascii?Q?qaFgYFE4MWpU0mm8bFFX0dU0fLMzfKtzliX6JRzw8awd6pOtilsLo9krhrNi?=
 =?us-ascii?Q?ZL0xr244TwcAlRwlox8fi13SYINT05sZNgdm8JHxSXZkSb+17JMZlrI69u+k?=
 =?us-ascii?Q?+7TFf6urZxClmMGyUeS8WLZZZMddKSF+8o+AZlB+EoeJv2PGAd/Hvmtjl0CL?=
 =?us-ascii?Q?AwD1orDBJwQG6qPtlnld0i9TZieZPZKqPLzXqqxyyqzQwMkk2zW7iOZC18YN?=
 =?us-ascii?Q?FUz1c4b4Ex3ReV/ohAMZ6GCks/DQuLzpnwKFLDS1fGTubSw4bmOB+B1Xdgm5?=
 =?us-ascii?Q?ttbuGxN3jbAR66q+dzmBrXMva507iLn7zNUM/KxiJoSyJy/i1rY18LaAEit4?=
 =?us-ascii?Q?mh5BJHoXQ/eyWAPAr/nNOFlir2QULoNngBUsBvR4gB1rU6OerjfGiX46MfZ3?=
 =?us-ascii?Q?gM+6G9bd0g1DB2SOTUJD5Bho8n1orGWtGHz3ULx+6eT6tx8n46oIgknkrntm?=
 =?us-ascii?Q?yhuNdOp0FKMIIUq0vQHAKWSlQOz+ZF7dNdVgjlv94Ng5DTw1rAR1uk32eV52?=
 =?us-ascii?Q?bfNaM2arbjWQSpfcxrM4CSA5MEuDzKykQ1LJV+VCGCfO4KM2BDnsazYm2G6b?=
 =?us-ascii?Q?hhOQ5i+A9s3RDcVf1r/3vY5oTeAqoV6/s/fiLO3vV8LbA+Js/NYFa5PTfAe7?=
 =?us-ascii?Q?kALZ8/vl7kmy78emJOFN+BiiT7MxGfRxpOEPAknmce44SHIQq20r9W3F/Rth?=
 =?us-ascii?Q?9ogToIqg9+ATdjNCNvC/qIV2?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8d2ebf35-536a-49b5-811d-08d96f43fcbe
X-MS-Exchange-CrossTenant-AuthSource: BYAPR10MB2966.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2021 01:33:24.6429
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: wZP8PYjxtyv9UEDHmQZQzm8UEhwDXn2TjbxXM9fskIFhT/cTn5UHbxJ7/CL+7TwZ8D1IspkfdtT7GP/HtES7rw8jPF42XYYiT2+GgsTu5VM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR10MB4321
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10096 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 spamscore=0 mlxlogscore=999
 adultscore=0 bulkscore=0 suspectscore=0 malwarescore=0 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2108310000
 definitions=main-2109040007
X-Proofpoint-ORIG-GUID: BUkGC17EQk-B_mAvJkNFpYwZ8VlPzIQ7
X-Proofpoint-GUID: BUkGC17EQk-B_mAvJkNFpYwZ8VlPzIQ7
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

On Thu, Sep 02, 2021 at 04:36:25PM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    3e12361b6d23 bcm63xx_enet: delete a redundant assignment
> git tree:       net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=160cec72300000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=63a23a80f42a8989
> dashboard link: https://syzkaller.appspot.com/bug?extid=b187b77c8474f9648fae
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=144d07b6300000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=171b7fca300000
> 
> The issue was bisected to:
> 
> commit 4611ce22468895acd61fee9ac1da810d60617d9a
> Author: Daniel Jordan <daniel.m.jordan@oracle.com>
> Date:   Wed Jun 3 22:59:39 2020 +0000
> 
>     padata: allocate work structures for parallel jobs from a pool
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=118dccae300000
> console output: https://syzkaller.appspot.com/x/log.txt?x=158dccae300000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b187b77c8474f9648fae@syzkaller.appspotmail.com
> Fixes: 4611ce224688 ("padata: allocate work structures for parallel jobs from a pool")
> 
> ==================================================================
> BUG: KASAN: use-after-free in __crypto_xor+0x376/0x410 crypto/algapi.c:1001
> Read of size 8 at addr ffff88803691a000 by task kworker/u4:1/10

The reproducer hasn't tripped over this yet, but I'll keep trying.