syzbot


KASAN: use-after-free Read in sctp_auth_free
Status: internal: reported C repro on 2020/10/07 18:29
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: d42ee76e net-backports: sctp: fix sctp_auth_init_hmacs() error path
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386]
First crash: 18d, last: 17d

Cause bisection: introduced by (bisect log) :
commit 56dd525abd56f7acd7b44a52935726e3ada4916c
Author: Xin Long <lucien.xin@gmail.com>
Date: Mon Aug 19 14:02:49 2019 +0000

  sctp: add SCTP_AUTH_SUPPORTED sockopt

Crash: KASAN: use-after-free Read in sctp_auth_destroy_hmacs (log)
Repro: C syz .config

Sample crash report:

Crashes (4):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Maintainers
ci-upstream-kasan-gce 2020/10/07 18:40 upstream c85fb28b 1880b4a9 .config log report syz C davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-sctp@vger.kernel.org, marcelo.leitner@gmail.com, netdev@vger.kernel.org, nhorman@tuxdriver.com, vyasevich@gmail.com
ci-upstream-kasan-gce 2020/10/09 04:31 upstream 3d006ee4 92390980 .config log report info davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-sctp@vger.kernel.org, marcelo.leitner@gmail.com, netdev@vger.kernel.org, nhorman@tuxdriver.com, vyasevich@gmail.com
ci-upstream-kasan-gce 2020/10/07 18:28 upstream c85fb28b 1880b4a9 .config log report info davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-sctp@vger.kernel.org, marcelo.leitner@gmail.com, netdev@vger.kernel.org, nhorman@tuxdriver.com, vyasevich@gmail.com
ci-upstream-net-this-kasan-gce 2020/10/08 02:03 net d91dc434 1880b4a9 .config log report info davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-sctp@vger.kernel.org, marcelo.leitner@gmail.com, netdev@vger.kernel.org, nhorman@tuxdriver.com, vyasevich@gmail.com