KASAN: stack-out-of-bounds Read in xfrm_selector

Title	Replies (including bot)	Last reply
[PATCH 5.8 000/124] 5.8.15-rc1 review	136 (136)	2020/10/14 18:31
[PATCH 4.4 00/39] 4.4.239-rc1 review	46 (46)	2020/10/14 10:18
[PATCH 4.19 00/49] 4.19.151-rc1 review	56 (56)	2020/10/14 08:34
[PATCH 4.9 00/54] 4.9.239-rc1 review	58 (58)	2020/10/14 01:39
[PATCH 4.14 00/70] 4.14.201-rc1 review	74 (74)	2020/10/14 01:28
[PATCH 5.4 00/85] 5.4.71-rc1 review	89 (89)	2020/10/14 01:24
[PATCH 8/8] xfrm: Use correct address family in xfrm_state_find	1 (1)	2020/09/28 08:24
[PATCH] xfrm: Use correct address family in xfrm_state_find	2 (2)	2020/09/28 05:07
KASAN: stack-out-of-bounds Read in xfrm_selector_match (2)	5 (6)	2020/09/28 02:21

Title

Replies (including bot)

Last reply

[PATCH 5.8 000/124] 5.8.15-rc1 review

136 (136)

2020/10/14 18:31

[PATCH 4.4 00/39] 4.4.239-rc1 review

46 (46)

2020/10/14 10:18

[PATCH 4.19 00/49] 4.19.151-rc1 review

56 (56)

2020/10/14 08:34

[PATCH 4.9 00/54] 4.9.239-rc1 review

58 (58)

2020/10/14 01:39

[PATCH 4.14 00/70] 4.14.201-rc1 review

74 (74)

2020/10/14 01:28

[PATCH 5.4 00/85] 5.4.71-rc1 review

89 (89)

2020/10/14 01:24

[PATCH 8/8] xfrm: Use correct address family in xfrm_state_find

1 (1)

2020/09/28 08:24

[PATCH] xfrm: Use correct address family in xfrm_state_find

2 (2)

2020/09/28 05:07

KASAN: stack-out-of-bounds Read in xfrm_selector_match (2)

5 (6)

2020/09/28 02:21

Kernel	Title	Repro	Count	Last	Reported	Patched	Status
android-49	KASAN: stack-out-of-bounds Read in xfrm_selector_match	C	672	2270d	2737d	0/3	closed as invalid on 2018/11/08 02:37
upstream	KASAN: stack-out-of-bounds Read in xfrm_selector_match net		368	2567d	2574d	4/28	fixed on 2018/02/13 04:59
android-44	KASAN: stack-out-of-bounds Read in xfrm_selector_match	C	36	2280d	2112d	0/2	public: reported C repro on 2019/04/11 08:44
android-414	KASAN: stack-out-of-bounds Read in xfrm_selector_match		1	1918d	1918d	0/1	auto-closed as invalid on 2020/02/19 14:26
android-49	KASAN: stack-out-of-bounds Read in xfrm_selector_match (2)	C	13	1916d	2110d	0/3	public: reported C repro on 2019/04/13 00:00

================================================================== BUG: KASAN: stack-out-of-bounds in xfrm_flowi_dport include/net/xfrm.h:877 [inline] BUG: KASAN: stack-out-of-bounds in __xfrm6_selector_match net/xfrm/xfrm_policy.c:216 [inline] BUG: KASAN: stack-out-of-bounds in xfrm_selector_match+0xf36/0xf60 net/xfrm/xfrm_policy.c:229 Read of size 2 at addr ffffc9001914f55c by task syz-executor.4/15633 CPU: 0 PID: 15633 Comm: syz-executor.4 Not tainted 5.9.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x198/0x1fd lib/dump_stack.c:118 print_address_description.constprop.0.cold+0x5/0x497 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 xfrm_flowi_dport include/net/xfrm.h:877 [inline] __xfrm6_selector_match net/xfrm/xfrm_policy.c:216 [inline] xfrm_selector_match+0xf36/0xf60 net/xfrm/xfrm_policy.c:229 xfrm_state_look_at.constprop.0+0x144/0x3f0 net/xfrm/xfrm_state.c:1022 xfrm_state_find+0x1a16/0x4d50 net/xfrm/xfrm_state.c:1092 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2384 [inline] xfrm_tmpl_resolve+0x2f3/0xd40 net/xfrm/xfrm_policy.c:2429 xfrm_resolve_and_create_bundle+0x123/0x2590 net/xfrm/xfrm_policy.c:2719 xfrm_lookup_with_ifid+0x235/0x2130 net/xfrm/xfrm_policy.c:3053 xfrm_lookup net/xfrm/xfrm_policy.c:3177 [inline] xfrm_lookup_route+0x36/0x1e0 net/xfrm/xfrm_policy.c:3188 ip_route_output_flow+0xa6/0xc0 net/ipv4/route.c:2769 udp_sendmsg+0x1a16/0x26c0 net/ipv4/udp.c:1201 udpv6_sendmsg+0x14dd/0x2b90 net/ipv6/udp.c:1344 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:638 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:671 ____sys_sendmsg+0x331/0x810 net/socket.c:2353 ___sys_sendmsg+0xf3/0x170 net/socket.c:2407 __sys_sendmmsg+0x195/0x480 net/socket.c:2497 __do_sys_sendmmsg net/socket.c:2526 [inline] __se_sys_sendmmsg net/socket.c:2523 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2523 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45d5f9 Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f8aa009cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 0000000000027a40 RCX: 000000000045d5f9 RDX: 00000000000005c3 RSI: 0000000020000240 RDI: 0000000000000004 RBP: 000000000118cf88 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cf4c R13: 000000000169fb6f R14: 00007f8aa009d9c0 R15: 000000000118cf4c addr ffffc9001914f55c is located in stack of task syz-executor.4/15633 at offset 220 in frame: udp_sendmsg+0x0/0x26c0 net/ipv4/udp.c:2708 this frame has 5 objects: [32, 40) 'rt' [64, 104) 'ipc' [144, 200) 'fl4_stack' [240, 296) 'cork' [336, 408) 'opt_copy' Memory state around the buggy address: ffffc9001914f400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc9001914f480: f1 f1 f1 f1 00 f2 f2 f2 00 00 00 00 00 f2 f2 f2 >ffffc9001914f500: f2 f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 ^ ffffc9001914f580: 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 ffffc9001914f600: 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 ==================================================================