From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754943AbeATMzE (ORCPT ); Sat, 20 Jan 2018 07:55:04 -0500 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:34157 "EHLO out1-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751269AbeATMyz (ORCPT ); Sat, 20 Jan 2018 07:54:55 -0500 X-ME-Sender: Date: Sat, 20 Jan 2018 14:54:51 +0200 From: Ido Schimmel To: syzbot Cc: davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com, yoshfuji@linux-ipv6.org, weiwan@google.com Subject: Re: KASAN: use-after-free Read in fib6_ifup (2) Message-ID: <20180120125451.GA25227@splinter> References: <001a11444e645c220905631ac3dc@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <001a11444e645c220905631ac3dc@google.com> User-Agent: Mutt/1.9.1 (2017-09-22) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jan 18, 2018 at 09:58:01PM -0800, syzbot wrote: > Hello, > > syzbot hit the following crash on net-next commit > 564737f981fb4b4b3266901508bb9b90d9d43de8 > > So far this crash happened 18 times on mmots, net-next. > C reproducer is attached. > syzkaller reproducer is attached. > Raw console output is attached. > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached. [...] > syzbot will keep track of this bug report. > If you forgot to add the Reported-by tag, once the fix for this bug is > merged > into any tree, please reply to this email with: > #syz fix: exact-commit-title The reproducer configures a default source-specific route which triggers a bug that is now fixed in net-next, so: #syz fix: ipv6: don't let tb6_root node share routes with other node Verified it on my machine using the reproducer attached by the bot.