syzbot


KASAN: slab-out-of-bounds Write in setup_udp_tunnel_sock (2)
Status: internal: reported C repro on 2020/01/21 03:01
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 940ba149 net-backports: gtp: make sure only SOCK_DGRAM UDP sockets are accepted
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-upstream-kmsan-gce]
First crash: 27d, last: 25d

Cause bisection: introduced by (bisect log):

commit 382ae57d5e52a62e77d62e60e5be9a6526d40da0
Author: Ryder Lee <ryder.lee@mediatek.com>
Date: Fri Jan 20 05:41:10 2017 +0000

  crypto: mediatek - make crypto request queue management more generic

Crash: general protection fault in batadv_iv_ogm_queue_add (log)
Repro: C syz .config
similar bugs (3):
Kernel Title Repro Bisected Count Last Reported Patched Status
linux-4.19 KASAN: slab-out-of-bounds Write in setup_udp_tunnel_sock C 1 25d 25d 0/1 upstream: reported C repro on 2020/01/23 07:53
linux-4.14 KASAN: slab-out-of-bounds Write in setup_udp_tunnel_sock C 1 24d 24d 0/1 upstream: reported C repro on 2020/01/24 02:19
upstream KASAN: slab-out-of-bounds Write in setup_udp_tunnel_sock C 4 713d 713d 4/16 fixed on 2018/03/23 18:14

Sample crash report:

Crashes (8):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro Maintainers
ci-upstream-kasan-gce-selinux-root 2020/01/23 03:09 upstream dbab40bd 3334d684 .config log report syz C davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-upstream-kasan-gce-root 2020/01/22 20:40 upstream d96d875e 8eda0b95 .config log report syz C davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-upstream-kasan-gce-smack-root 2020/01/21 20:15 upstream d96d875e 8eda0b95 .config log report syz C davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-upstream-kasan-gce 2020/01/21 18:35 upstream d96d875e 8eda0b95 .config log report syz C davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-upstream-net-this-kasan-gce 2020/01/21 04:15 net 7008ee12 d2557fb5 .config log report syz C davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-upstream-net-kasan-gce 2020/01/21 03:32 net-next b3f7e3f2 d2557fb5 .config log report syz C davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-upstream-kasan-gce-386 2020/01/21 14:12 upstream d96d875e 8eda0b95 .config log report syz davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-upstream-net-kasan-gce 2020/01/21 03:00 net-next b3f7e3f2 d2557fb5 .config log report davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org