syzbot


KASAN: use-after-free Read in tcp_fastretrans_alert
Status: fixed on 2020/02/18 14:31
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 2bec445f net-backports: tcp: do not leave dangling pointers in tp->highest_sack
First crash: 34d, last: 34d

Cause bisection: introduced by (bisect log):

commit 853697504de043ff0bfd815bd3a64de1dce73dc7
Author: Cambda Zhu <cambda@linux.alibaba.com>
Date: Fri Dec 27 08:52:37 2019 +0000

  tcp: Fix highest_sack and highest_sack_seq

Crash: KASAN: use-after-free Read in tcp_check_sack_reordering (log)
Repro: C syz .config

Sample crash report:

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro Maintainers
ci-upstream-kasan-gce-smack-root 2020/01/18 13:24 upstream 25e73aad 3de7aabb .config log report syz C andriin@fb.com, ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, davem@davemloft.net, edumazet@google.com, kafai@fb.com, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, songliubraving@fb.com, yhs@fb.com, yoshfuji@linux-ipv6.org