From: Eric Biggers <ebiggers3@gmail.com>
To: "Stephan Müller" <smueller@chronox.de>
Cc: syzbot
<bot+6fbc13c3b1ed2105e7a2e516be43d6a0624a59c0@syzkaller.appspotmail.com>,
davem@davemloft.net, herbert@gondor.apana.org.au,
linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: KASAN: use-after-free Read in aead_recvmsg
Date: Mon, 27 Nov 2017 14:43:08 -0800 [thread overview]
Message-ID: <20171127224308.GB8426@gmail.com> (raw)
In-Reply-To: <2409323.isfI9bk5QC@positron.chronox.de>
On Mon, Nov 27, 2017 at 11:02:08PM +0100, Stephan Müller wrote:
> Am Montag, 27. November 2017, 19:56:46 CET schrieb syzbot:
>
> Hi,
>
> > Hello,
> >
> > syzkaller hit the following crash on
> > 6fc478f80f6809cc4b1a4230f47a62d3b7378dc0
> > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
> > compiler: gcc (GCC) 7.1.1 20170620
> > .config is attached
> > Raw console output is attached.
> > C reproducer is attached
> > syzkaller reproducer is attached. See https://goo.gl/kgGztJ
> > for information about syzkaller reproducers
>
> Could you please re-perform the test applying the patch https://
> git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git/commit/?
> id=8e1fa89aa8bc2870009b4486644e4a58f2e2a4f5 ?
>
> At least I am not able to reproduce that issue using the repro.c with the
> patch applied.
>
No, that doesn't help. I tested v4.15-rc1 with all the extra commits from
crypto-2.6.git/master applied:
crypto: algif_aead - skip SGL entries with NULL page
crypto: af_alg - remove locking in async callback
crypto: skcipher - Fix skcipher_walk_aead_common
Did you use the .config the bot provided? It's possible the bug is only
noticable with KASAN enabled.
Eric
next prev parent reply other threads:[~2017-11-27 22:43 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-27 18:56 KASAN: use-after-free Read in aead_recvmsg syzbot
2017-11-27 22:02 ` Stephan Müller
2017-11-27 22:43 ` Eric Biggers [this message]
2017-11-28 6:30 ` Stephan Mueller
2017-11-28 7:29 ` Eric Biggers
2017-11-28 7:43 ` Stephan Mueller
2017-11-29 5:23 ` Herbert Xu
2017-12-01 19:11 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171127224308.GB8426@gmail.com \
--to=ebiggers3@gmail.com \
--cc=bot+6fbc13c3b1ed2105e7a2e516be43d6a0624a59c0@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=smueller@chronox.de \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.