From: Florian Westphal <fw at strlen.de>
To: mptcp at lists.01.org
Subject: [MPTCP] Re: [syzkaller] KASAN: slab-out-of-bounds Write in tcp_mstamp_refresh
Date: Fri, 24 Jan 2020 18:55:50 +0100 [thread overview]
Message-ID: <20200124175550.GX795@breakpoint.cc> (raw)
In-Reply-To: 20200124171916.GH60524@MacBook-Pro-64.local
[-- Attachment #1: Type: text/plain, Size: 1000 bytes --]
Christoph Paasch <cpaasch(a)apple.com> wrote:
> One more:
>
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
> Write of size 8 at addr ffff888116aa21d0 by task syz-executor.0/5478
Ugh.
> tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
> tcp_rcv_space_adjust+0x72/0x7f0 net/ipv4/tcp_input.c:612
> tcp_read_sock+0x622/0x990 net/ipv4/tcp.c:1674
> __tcp_splice_read net/ipv4/tcp.c:749 [inline]
> tcp_splice_read+0x20b/0xb40 net/ipv4/tcp.c:791
> sock_splice_read+0xb9/0x120 net/socket.c:962
> do_splice_to+0x111/0x160 fs/splice.c:892
> do_splice+0x1259/0x1560 fs/splice.c:1205
> __do_sys_splice fs/splice.c:1447 [inline]
> __se_sys_splice fs/splice.c:1427 [inline]
> __x64_sys_splice+0x2b7/0x320 fs/splice.c:1427
> do_syscall_64+0xbd/0x5b0 arch/x86/entry/common.c:294
mptcp allows calls into tcp proto ops on mptcp socket.
I'm trying a fix shortly.
next reply other threads:[~2020-01-24 17:55 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-24 17:55 Florian Westphal [this message]
-- strict thread matches above, loose matches on Subject: below --
2020-01-24 19:20 [MPTCP] Re: [syzkaller] KASAN: slab-out-of-bounds Write in tcp_mstamp_refresh Christoph Paasch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200124175550.GX795@breakpoint.cc \
--to=unknown@example.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.