syzbot


KASAN: use-after-free Read in tcp_check_sack_reordering
Status: fixed on 2020/02/18 14:31
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 2bec445f net-backports: tcp: do not leave dangling pointers in tp->highest_sack
First crash: 251d, last: 243d

Cause bisection: introduced by (bisect log):

commit 853697504de043ff0bfd815bd3a64de1dce73dc7
Author: Cambda Zhu <cambda@linux.alibaba.com>
Date: Fri Dec 27 08:52:37 2019 +0000

  tcp: Fix highest_sack and highest_sack_seq

Crash: KASAN: use-after-free Read in tcp_check_sack_reordering (log)
Repro: C syz .config
similar bugs (1):
Kernel Title Repro Bisected Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in tcp_check_sack_reordering C fix 1 250d 250d 1/1 fixed on 2020/02/19 00:41

Sample crash report:

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Maintainers
ci-upstream-net-kasan-gce 2020/01/18 10:09 net-next 56f200c7 3de7aabb .config log report syz C andriin@fb.com, ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, davem@davemloft.net, edumazet@google.com, kafai@fb.com, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, songliubraving@fb.com, yhs@fb.com, yoshfuji@linux-ipv6.org
ci-upstream-linux-next-kasan-gce-root 2020/01/27 07:21 linux-next 2747d5fd dd56146d .config log report syz C andriin@fb.com, ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, davem@davemloft.net, edumazet@google.com, kafai@fb.com, kuba@kernel.org, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, songliubraving@fb.com, yhs@fb.com, yoshfuji@linux-ipv6.org