syzbot


KASAN: use-after-free Read in tcp_check_sack_reordering
Status: fixed on 2020/02/18 14:31
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 2bec445f9bf3 net-backports: tcp: do not leave dangling pointers in tp->highest_sack
First crash: 686d, last: 677d

Cause bisection: introduced by (bisect log) :
commit 853697504de043ff0bfd815bd3a64de1dce73dc7
Author: Cambda Zhu <cambda@linux.alibaba.com>
Date: Fri Dec 27 08:52:37 2019 +0000

  tcp: Fix highest_sack and highest_sack_seq

Crash: KASAN: use-after-free Read in tcp_check_sack_reordering (log)
Repro: C syz .config
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in tcp_check_sack_reordering C done 1 685d 685d 1/1 fixed on 2020/02/19 00:41

Sample crash report:

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-net-kasan-gce 2020/01/18 10:09 net-next 56f200c78ce4 3de7aabb .config log report syz C
ci-upstream-linux-next-kasan-gce-root 2020/01/27 07:21 linux-next 2747d5fdab78 dd56146d .config log report syz C