syzbot


KASAN: use-after-free Read in eth_type_trans
Status: fixed on 2020/12/23 11:40
Reported-by: syzbot+6745e272378d071cac7f@syzkaller.appspotmail.com
Fix commit: 96aa1b22bd6b tun: correct header offsets in napi frags mode
First crash: 718d, last: 571d

Cause bisection: introduced by (bisect log) :
commit 90e33d45940793def6f773b2d528e9f3c84ffdc7
Author: Petar Penkov <peterpenkov96@gmail.com>
Date: Fri Sep 22 20:49:15 2017 +0000

  tun: enable napi_gro_frags() for TUN/TAP driver

Crash: KASAN: use-after-free Read in eth_type_trans (log)
Repro: C syz .config

Fix bisection: failed (bisect log)
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in eth_type_trans C error 1 447d 718d 0/1 upstream: reported C repro on 2019/12/19 12:15

Sample crash report:

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2019/12/19 23:09 upstream 4a94c4332334 36650b4b .config log report syz C
ci-upstream-kasan-gce-selinux-root 2019/12/19 14:49 upstream 4a94c4332334 79b211f7 .config log report syz C
ci-upstream-linux-next-kasan-gce-root 2019/12/27 20:52 linux-next 7ddd09fc4b74 be5c2c81 .config log report syz C