From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ido Schimmel Subject: Re: KASAN: use-after-free Read in fib6_ifup (2) Date: Sat, 20 Jan 2018 14:54:51 +0200 Message-ID: <20180120125451.GA25227@splinter> References: <001a11444e645c220905631ac3dc@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com, yoshfuji@linux-ipv6.org, weiwan@google.com To: syzbot Return-path: Content-Disposition: inline In-Reply-To: <001a11444e645c220905631ac3dc@google.com> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Thu, Jan 18, 2018 at 09:58:01PM -0800, syzbot wrote: > Hello, > > syzbot hit the following crash on net-next commit > 564737f981fb4b4b3266901508bb9b90d9d43de8 > > So far this crash happened 18 times on mmots, net-next. > C reproducer is attached. > syzkaller reproducer is attached. > Raw console output is attached. > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached. [...] > syzbot will keep track of this bug report. > If you forgot to add the Reported-by tag, once the fix for this bug is > merged > into any tree, please reply to this email with: > #syz fix: exact-commit-title The reproducer configures a default source-specific route which triggers a bug that is now fixed in net-next, so: #syz fix: ipv6: don't let tb6_root node share routes with other node Verified it on my machine using the reproducer attached by the bot.