syzbot


KASAN: slab-out-of-bounds Read in tcf_exts_destroy
Status: upstream: reported C repro on 2020/01/23 23:27
Reported-by: syzbot+35d4dea36c387813ed31@syzkaller.appspotmail.com
Fix commit: 599be01e net_sched: fix an OOB access in cls_tcindex
Patched on: [ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-upstream ci-qemu-upstream-386 ci-upstream-kmsan-gce]
First crash: 138d, last: 121d

Cause bisection: introduced by (bisect log):

commit 6e237d099fac1f73a7b6d7287bb9191f29585a4e
Author: David Ahern <dsahern@gmail.com>
Date: Thu Dec 7 04:09:12 2017 +0000

  netlink: Relax attr validation for fixed length types

Crash: WARNING: kmalloc bug in tcindex_alloc_perfect_hash (log)
Repro: C syz .config

Fix bisection: failed (bisect log)
similar bugs (2):
Kernel Title Repro Bisected Count Last Reported Patched Status
linux-4.19 KASAN: slab-out-of-bounds Read in tcf_exts_destroy C 1 6d16h 123d 0/1 upstream: reported C repro on 2019/10/17 02:15
linux-4.14 KASAN: slab-out-of-bounds Read in tcf_exts_destroy C 1 6d02h 119d 0/1 upstream: reported C repro on 2019/10/21 07:23

Sample crash report:

Crashes (8):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro Maintainers
ci-upstream-kasan-gce-selinux-root 2019/10/18 22:59 upstream 0e2adab6 8c88c9c1 .config log report syz C davem@davemloft.net, jhs@mojatatu.com, jiri@resnulli.us, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, xiyou.wangcong@gmail.com
ci-upstream-kasan-gce-root 2019/10/13 21:43 upstream da940012 2f661ec4 .config log report syz C davem@davemloft.net, jhs@mojatatu.com, jiri@resnulli.us, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, xiyou.wangcong@gmail.com
ci-upstream-kasan-gce-smack-root 2019/10/13 19:40 upstream da940012 2f661ec4 .config log report syz C davem@davemloft.net, jhs@mojatatu.com, jiri@resnulli.us, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, xiyou.wangcong@gmail.com
ci-upstream-kasan-gce 2019/10/06 05:48 upstream b145b0eb f3f7d9c8 .config log report syz C davem@davemloft.net, jhs@mojatatu.com, jiri@resnulli.us, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, xiyou.wangcong@gmail.com
ci-upstream-kasan-gce-386 2019/10/06 20:16 upstream 43b815c6 f3f7d9c8 .config log report syz C davem@davemloft.net, jhs@mojatatu.com, jiri@resnulli.us, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, xiyou.wangcong@gmail.com
ci-upstream-net-this-kasan-gce 2019/10/01 22:35 net 569aad4f b7a87a83 .config log report syz C davem@davemloft.net, jhs@mojatatu.com, jiri@resnulli.us, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, xiyou.wangcong@gmail.com
ci-upstream-net-kasan-gce 2019/10/02 15:14 net-next c01ebd6c 2e29b534 .config log report syz C davem@davemloft.net, jhs@mojatatu.com, jiri@resnulli.us, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, xiyou.wangcong@gmail.com
ci-upstream-linux-next-kasan-gce-root 2019/10/17 13:28 linux-next 3ef845da 8c88c9c1 .config log report syz C davem@davemloft.net, jhs@mojatatu.com, jiri@resnulli.us, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, xiyou.wangcong@gmail.com