From: Ido Schimmel <idosch@idosch.org>
To: syzbot <syzbot+22b2e8ffdc35d97b5942@syzkaller.appspotmail.com>
Cc: davem@davemloft.net, kuznet@ms2.inr.ac.ru,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
syzkaller-bugs@googlegroups.com, yoshfuji@linux-ipv6.org,
weiwan@google.com
Subject: Re: KASAN: use-after-free Read in fib6_ifup (2)
Date: Fri, 19 Jan 2018 15:19:50 +0200 [thread overview]
Message-ID: <20180119131949.GA19786@splinter> (raw)
In-Reply-To: <001a11444e645c220905631ac3dc@google.com>
On Thu, Jan 18, 2018 at 09:58:01PM -0800, syzbot wrote:
> Hello,
>
> syzbot hit the following crash on net-next commit
> 564737f981fb4b4b3266901508bb9b90d9d43de8
>
> So far this crash happened 18 times on mmots, net-next.
> C reproducer is attached.
> syzkaller reproducer is attached.
> Raw console output is attached.
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+22b2e8ffdc35d97b5942@syzkaller.appspotmail.com
> It will help syzbot understand when the bug is fixed. See footer for
> details.
> If you forward the report, please keep this part and the footer.
>
> device lo entered promiscuous mode
> device lo left promiscuous mode
> device lo entered promiscuous mode
> ==================================================================
> BUG: KASAN: use-after-free in fib6_ifup+0x212/0x220 net/ipv6/route.c:3573
After applying Wei's recent commit 7f8e6b09f32d ("ipv6: don't let
tb6_root node share routes with other node") on top of net-next I can no
longer reproduce the issue with the provided reproducer (repro.syz.txt).
Will try to understand the exact reason for the bug before marking this
as fixed.
next prev parent reply other threads:[~2018-01-19 13:19 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-19 5:58 KASAN: use-after-free Read in fib6_ifup (2) syzbot
2018-01-19 13:19 ` Ido Schimmel [this message]
2018-01-20 12:54 ` Ido Schimmel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180119131949.GA19786@splinter \
--to=idosch@idosch.org \
--cc=davem@davemloft.net \
--cc=kuznet@ms2.inr.ac.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzbot+22b2e8ffdc35d97b5942@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=weiwan@google.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.