All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jakub Sitnicki <jakub@cloudflare.com>
To: Ruan Bonan <bonan.ruan@u.nus.edu>
Cc: "john.fastabend@gmail.com" <john.fastabend@gmail.com>,
	"davem@davemloft.net" <davem@davemloft.net>,
	 "edumazet@google.com" <edumazet@google.com>,
	 "kuba@kernel.org" <kuba@kernel.org>,
	"pabeni@redhat.com" <pabeni@redhat.com>,
	 "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
	 "bpf@vger.kernel.org" <bpf@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"syzkaller@googlegroups.com" <syzkaller@googlegroups.com>
Subject: Re: [BUG] general protection fault in sock_map_link_update_prog - Reproducible with Syzkaller
Date: Wed, 23 Oct 2024 14:51:30 +0200	[thread overview]
Message-ID: <877c9z9e3x.fsf@cloudflare.com> (raw)
In-Reply-To: <TYZPR06MB680739AC616DD61587BE380AD94C2@TYZPR06MB6807.apcprd06.prod.outlook.com> (Ruan Bonan's message of "Tue, 22 Oct 2024 02:36:23 +0000")

On Tue, Oct 22, 2024 at 02:36 AM GMT, Ruan Bonan wrote:
> I used Syzkaller and found that there is KASAN: null-ptr-deref (general protection fault in
> sock_map_link_update_prog) in net/core/sock_map.c in v6.12.0-rc2, which also causes a KASAN:
> slab-use-after-free at the same time. It looks like a concurrency bug in the BPF related subsystems. The
> reproducer is available, and I have reproduced this bug with it manually. Currently I can only reproduce this
> bug with root privilege.
>
> The detailed reports, config file, and reproducer program are attached in this e-mail. If you need further
> details, please let me know.

Thanks for the report. I was also able to reproduce the KASAN splat with
the attached repro locally and will investigate futher.

I have a small ask - please use plain text for mailing the list in the
future - https://useplaintext.email/

-jkbs

  reply	other threads:[~2024-10-23 12:51 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-10-22  2:36 [BUG] general protection fault in sock_map_link_update_prog - Reproducible with Syzkaller Ruan Bonan
2024-10-23 12:51 ` Jakub Sitnicki [this message]
2024-10-23 13:04   ` Ruan Bonan
2025-01-10 14:08   ` Jakub Sitnicki

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=877c9z9e3x.fsf@cloudflare.com \
    --to=jakub@cloudflare.com \
    --cc=bonan.ruan@u.nus.edu \
    --cc=bpf@vger.kernel.org \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=john.fastabend@gmail.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=syzkaller@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.