From mboxrd@z Thu Jan 1 00:00:00 1970 From: syzbot Subject: KASAN: use-after-free Read in ip6_tnl_parse_tlv_enc_lim Date: Thu, 01 Nov 2018 09:51:04 -0700 Message-ID: <00000000000075906805799d39b4@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes Content-Transfer-Encoding: base64 To: davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com, yoshfuji@linux-ipv6.org Return-path: Received: from mail-io1-f72.google.com ([209.85.166.72]:39668 "EHLO mail-io1-f72.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726119AbeKBByv (ORCPT ); Thu, 1 Nov 2018 21:54:51 -0400 Received: by mail-io1-f72.google.com with SMTP id o8-v6so18109107iom.6 for ; Thu, 01 Nov 2018 09:51:04 -0700 (PDT) Sender: netdev-owner@vger.kernel.org List-ID: SGVsbG8sDQoNCnN5emJvdCBmb3VuZCB0aGUgZm9sbG93aW5nIGNyYXNoIG9uOg0KDQpIRUFEIGNv bW1pdDogICAgNDRhZGJhYzhmNzIxIE1lcmdlIGJyYW5jaCAnd29yay50dHktaW9jdGwnIG9mIGdp dDovL2dpdC5rZS4uDQpnaXQgdHJlZTogICAgICAgYnBmLW5leHQNCmNvbnNvbGUgb3V0cHV0OiBo dHRwczovL3N5emthbGxlci5hcHBzcG90LmNvbS94L2xvZy50eHQ/eD0xNjA0MzE4MzQwMDAwMA0K a2VybmVsIGNvbmZpZzogIGh0dHBzOi8vc3l6a2FsbGVyLmFwcHNwb3QuY29tL3gvLmNvbmZpZz94 PTljYjk4MWVlMDE0NjNkZWENCmRhc2hib2FyZCBsaW5rOiBodHRwczovL3N5emthbGxlci5hcHBz cG90LmNvbS9idWc/ZXh0aWQ9MmM4ZDhmY2NkNmNlY2U0ZWRlMmENCmNvbXBpbGVyOiAgICAgICBn Y2MgKEdDQykgOC4wLjEgMjAxODA0MTMgKGV4cGVyaW1lbnRhbCkNCg0KVW5mb3J0dW5hdGVseSwg SSBkb24ndCBoYXZlIGFueSByZXByb2R1Y2VyIGZvciB0aGlzIGNyYXNoIHlldC4NCg0KSU1QT1JU QU5UOiBpZiB5b3UgZml4IHRoZSBidWcsIHBsZWFzZSBhZGQgdGhlIGZvbGxvd2luZyB0YWcgdG8g dGhlIGNvbW1pdDoNClJlcG9ydGVkLWJ5OiBzeXpib3QrMmM4ZDhmY2NkNmNlY2U0ZWRlMmFAc3l6 a2FsbGVyLmFwcHNwb3RtYWlsLmNvbQ0KDQrvv73vv70277+977+9Ye+/vX5JeU3vv70S77+9OiBy ZW5hbWVkIGZyb20gbnIwAQ0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09DQpCVUc6IEtBU0FOOiB1c2UtYWZ0ZXItZnJlZSBp biBpcDZfdG5sX3BhcnNlX3Rsdl9lbmNfbGltKzB4NWRmLzB4NjYwICANCm5ldC9pcHY2L2lwNl90 dW5uZWwuYzo0MTcNClJlYWQgb2Ygc2l6ZSAxIGF0IGFkZHIgZmZmZjg4MDFjYTIxMjI3ZiBieSB0 YXNrIHN5ei1leGVjdXRvcjAvMTEyMzkNCg0KQ1BVOiAxIFBJRDogMTEyMzkgQ29tbTogc3l6LWV4 ZWN1dG9yMCBOb3QgdGFpbnRlZCA0LjE5LjArICMxMzUNCkhhcmR3YXJlIG5hbWU6IEdvb2dsZSBH b29nbGUgQ29tcHV0ZSBFbmdpbmUvR29vZ2xlIENvbXB1dGUgRW5naW5lLCBCSU9TICANCkdvb2ds ZSAwMS8wMS8yMDExDQpDYWxsIFRyYWNlOg0KICBfX2R1bXBfc3RhY2sgbGliL2R1bXBfc3RhY2su Yzo3NyBbaW5saW5lXQ0KICBkdW1wX3N0YWNrKzB4MjQ0LzB4MzlkIGxpYi9kdW1wX3N0YWNrLmM6 MTEzDQogIHByaW50X2FkZHJlc3NfZGVzY3JpcHRpb24uY29sZC43KzB4OS8weDFmZiBtbS9rYXNh bi9yZXBvcnQuYzoyNTYNCiAga2FzYW5fcmVwb3J0X2Vycm9yIG1tL2thc2FuL3JlcG9ydC5jOjM1 NCBbaW5saW5lXQ0KICBrYXNhbl9yZXBvcnQuY29sZC44KzB4MjQyLzB4MzA5IG1tL2thc2FuL3Jl cG9ydC5jOjQxMg0KICBfX2FzYW5fcmVwb3J0X2xvYWQxX25vYWJvcnQrMHgxNC8weDIwIG1tL2th c2FuL3JlcG9ydC5jOjQzMA0KICBpcDZfdG5sX3BhcnNlX3Rsdl9lbmNfbGltKzB4NWRmLzB4NjYw IG5ldC9pcHY2L2lwNl90dW5uZWwuYzo0MTcNCiAgaXA2aXA2X3RubF94bWl0IG5ldC9pcHY2L2lw Nl90dW5uZWwuYzoxMzQ4IFtpbmxpbmVdDQogIGlwNl90bmxfc3RhcnRfeG1pdCsweDQ5Zi8weDI1 YTAgbmV0L2lwdjYvaXA2X3R1bm5lbC5jOjE0MTINCiAgX19uZXRkZXZfc3RhcnRfeG1pdCBpbmNs dWRlL2xpbnV4L25ldGRldmljZS5oOjQzMzYgW2lubGluZV0NCiAgbmV0ZGV2X3N0YXJ0X3htaXQg aW5jbHVkZS9saW51eC9uZXRkZXZpY2UuaDo0MzQ1IFtpbmxpbmVdDQogIHhtaXRfb25lIG5ldC9j b3JlL2Rldi5jOjMyNTIgW2lubGluZV0NCiAgZGV2X2hhcmRfc3RhcnRfeG1pdCsweDI5NS8weGM5 MCBuZXQvY29yZS9kZXYuYzozMjY4DQogIF9fZGV2X3F1ZXVlX3htaXQrMHgyZjcxLzB4M2FkMCBu ZXQvY29yZS9kZXYuYzozODM4DQogIGRldl9xdWV1ZV94bWl0KzB4MTcvMHgyMCBuZXQvY29yZS9k ZXYuYzozODcxDQogIF9fYnBmX3R4X3NrYiBuZXQvY29yZS9maWx0ZXIuYzoyMDE3IFtpbmxpbmVd DQogIF9fYnBmX3JlZGlyZWN0X2NvbW1vbiBuZXQvY29yZS9maWx0ZXIuYzoyMDU1IFtpbmxpbmVd DQogIF9fYnBmX3JlZGlyZWN0KzB4NWNmLzB4YjIwIG5ldC9jb3JlL2ZpbHRlci5jOjIwNjINCiAg X19fX2JwZl9jbG9uZV9yZWRpcmVjdCBuZXQvY29yZS9maWx0ZXIuYzoyMDk1IFtpbmxpbmVdDQog IGJwZl9jbG9uZV9yZWRpcmVjdCsweDJmNi8weDQ5MCBuZXQvY29yZS9maWx0ZXIuYzoyMDY3DQog IGJwZl9wcm9nXzc1OWE5OTJjNTc4YTM4OTQrMHg3ZDcvMHgxMDAwDQoNCkFsbG9jYXRlZCBieSB0 YXNrIDEwNzcxOg0KICBzYXZlX3N0YWNrKzB4NDMvMHhkMCBtbS9rYXNhbi9rYXNhbi5jOjQ0OA0K ICBzZXRfdHJhY2sgbW0va2FzYW4va2FzYW4uYzo0NjAgW2lubGluZV0NCiAga2FzYW5fa21hbGxv YysweGM3LzB4ZTAgbW0va2FzYW4va2FzYW4uYzo1NTMNCiAga2FzYW5fc2xhYl9hbGxvYysweDEy LzB4MjAgbW0va2FzYW4va2FzYW4uYzo0OTANCiAga21lbV9jYWNoZV9hbGxvYysweDEyZS8weDcz MCBtbS9zbGFiLmM6MzU1NA0KICBnZXRuYW1lX2ZsYWdzKzB4ZDAvMHg1YTAgZnMvbmFtZWkuYzox NDANCiAgZ2V0bmFtZSBmcy9uYW1laS5jOjIxMSBbaW5saW5lXQ0KICB1c2VyX3BhdGhfY3JlYXRl IGZzL25hbWVpLmM6MzY5MyBbaW5saW5lXQ0KICBkb19zeW1saW5rYXQrMHhlOS8weDJkMCBmcy9u YW1laS5jOjQxNDcNCiAgX19kb19zeXNfc3ltbGluayBmcy9uYW1laS5jOjQxNzMgW2lubGluZV0N CiAgX19zZV9zeXNfc3ltbGluayBmcy9uYW1laS5jOjQxNzEgW2lubGluZV0NCiAgX194NjRfc3lz X3N5bWxpbmsrMHg1OS8weDgwIGZzL25hbWVpLmM6NDE3MQ0KICBkb19zeXNjYWxsXzY0KzB4MWI5 LzB4ODIwIGFyY2gveDg2L2VudHJ5L2NvbW1vbi5jOjI5MA0KICBlbnRyeV9TWVNDQUxMXzY0X2Fm dGVyX2h3ZnJhbWUrMHg0OS8weGJlDQoNCkZyZWVkIGJ5IHRhc2sgMTA3NzE6DQogIHNhdmVfc3Rh Y2srMHg0My8weGQwIG1tL2thc2FuL2thc2FuLmM6NDQ4DQogIHNldF90cmFjayBtbS9rYXNhbi9r YXNhbi5jOjQ2MCBbaW5saW5lXQ0KICBfX2thc2FuX3NsYWJfZnJlZSsweDEwMi8weDE1MCBtbS9r YXNhbi9rYXNhbi5jOjUyMQ0KICBrYXNhbl9zbGFiX2ZyZWUrMHhlLzB4MTAgbW0va2FzYW4va2Fz YW4uYzo1MjgNCiAgX19jYWNoZV9mcmVlIG1tL3NsYWIuYzozNDk4IFtpbmxpbmVdDQogIGttZW1f Y2FjaGVfZnJlZSsweDgzLzB4MjkwIG1tL3NsYWIuYzozNzU2DQogIHB1dG5hbWUrMHhmMi8weDEz MCBmcy9uYW1laS5jOjI2MQ0KICBmaWxlbmFtZV9jcmVhdGUrMHgyYjIvMHg1YjAgZnMvbmFtZWku YzozNjU4DQogIHVzZXJfcGF0aF9jcmVhdGUgZnMvbmFtZWkuYzozNjkzIFtpbmxpbmVdDQogIGRv X3N5bWxpbmthdCsweGZlLzB4MmQwIGZzL25hbWVpLmM6NDE0Nw0KICBfX2RvX3N5c19zeW1saW5r IGZzL25hbWVpLmM6NDE3MyBbaW5saW5lXQ0KICBfX3NlX3N5c19zeW1saW5rIGZzL25hbWVpLmM6 NDE3MSBbaW5saW5lXQ0KICBfX3g2NF9zeXNfc3ltbGluaysweDU5LzB4ODAgZnMvbmFtZWkuYzo0 MTcxDQogIGRvX3N5c2NhbGxfNjQrMHgxYjkvMHg4MjAgYXJjaC94ODYvZW50cnkvY29tbW9uLmM6 MjkwDQogIGVudHJ5X1NZU0NBTExfNjRfYWZ0ZXJfaHdmcmFtZSsweDQ5LzB4YmUNCg0KVGhlIGJ1 Z2d5IGFkZHJlc3MgYmVsb25ncyB0byB0aGUgb2JqZWN0IGF0IGZmZmY4ODAxY2EyMTIxNDANCiAg d2hpY2ggYmVsb25ncyB0byB0aGUgY2FjaGUgbmFtZXNfY2FjaGUgb2Ygc2l6ZSA0MDk2DQpUaGUg YnVnZ3kgYWRkcmVzcyBpcyBsb2NhdGVkIDMxOSBieXRlcyBpbnNpZGUgb2YNCiAgNDA5Ni1ieXRl IHJlZ2lvbiBbZmZmZjg4MDFjYTIxMjE0MCwgZmZmZjg4MDFjYTIxMzE0MCkNClRoZSBidWdneSBh ZGRyZXNzIGJlbG9uZ3MgdG8gdGhlIHBhZ2U6DQpwYWdlOmZmZmZlYTAwMDcyODg0ODAgY291bnQ6 MSBtYXBjb3VudDowIG1hcHBpbmc6ZmZmZjg4MDFkYTk3M2Q4MCBpbmRleDoweDAgIA0KY29tcG91 bmRfbWFwY291bnQ6IDANCmZsYWdzOiAweDJmZmZjMDAwMDAwODEwMChzbGFifGhlYWQpDQpyYXc6 IDAyZmZmYzAwMDAwMDgxMDAgZmZmZmVhMDAwNmRkNjI4OCBmZmZmZWEwMDA3MjIzOTg4IGZmZmY4 ODAxZGE5NzNkODANCnJhdzogMDAwMDAwMDAwMDAwMDAwMCBmZmZmODgwMWNhMjEyMTQwIDAwMDAw MDAxMDAwMDAwMDEgMDAwMDAwMDAwMDAwMDAwMA0KcGFnZSBkdW1wZWQgYmVjYXVzZToga2FzYW46 IGJhZCBhY2Nlc3MgZGV0ZWN0ZWQNCg0KTWVtb3J5IHN0YXRlIGFyb3VuZCB0aGUgYnVnZ3kgYWRk cmVzczoNCiAgZmZmZjg4MDFjYTIxMjEwMDogZmMgZmMgZmMgZmMgZmMgZmMgZmMgZmMgZmIgZmIg ZmIgZmIgZmIgZmIgZmIgZmINCiAgZmZmZjg4MDFjYTIxMjE4MDogZmIgZmIgZmIgZmIgZmIgZmIg ZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmINCj4gZmZmZjg4MDFjYTIxMjIwMDogZmIgZmIg ZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmIgZmINCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXg0KICBm ZmZmODgwMWNhMjEyMjgwOiBmYiBmYiBmYiBmYiBmYiBmYiBmYiBmYiBmYiBmYiBmYiBmYiBmYiBm YiBmYiBmYg0KICBmZmZmODgwMWNhMjEyMzAwOiBmYiBmYiBmYiBmYiBmYiBmYiBmYiBmYiBmYiBm YiBmYiBmYiBmYiBmYiBmYiBmYg0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09DQoNCg0KLS0tDQpUaGlzIGJ1ZyBpcyBnZW5l cmF0ZWQgYnkgYSBib3QuIEl0IG1heSBjb250YWluIGVycm9ycy4NClNlZSBodHRwczovL2dvby5n bC90cHNtRUogZm9yIG1vcmUgaW5mb3JtYXRpb24gYWJvdXQgc3l6Ym90Lg0Kc3l6Ym90IGVuZ2lu ZWVycyBjYW4gYmUgcmVhY2hlZCBhdCBzeXprYWxsZXJAZ29vZ2xlZ3JvdXBzLmNvbS4NCg0Kc3l6 Ym90IHdpbGwga2VlcCB0cmFjayBvZiB0aGlzIGJ1ZyByZXBvcnQuIFNlZToNCmh0dHBzOi8vZ29v LmdsL3Rwc21FSiNidWctc3RhdHVzLXRyYWNraW5nIGZvciBob3cgdG8gY29tbXVuaWNhdGUgd2l0 aCAgDQpzeXpib3QuDQo=