From: Steffen Klassert <steffen.klassert@secunet.com>
To: Alexei Starovoitov <ast@kernel.org>
Cc: "David S . Miller" <davem@davemloft.net>, <daniel@iogearbox.net>,
<edumazet@google.com>, <netdev@vger.kernel.org>,
<kernel-team@fb.com>
Subject: Re: [PATCH net] net/xfrm: fix out-of-bounds packet access
Date: Fri, 12 Oct 2018 12:09:47 +0200 [thread overview]
Message-ID: <20181012100947.GD30955@gauss3.secunet.de> (raw)
In-Reply-To: <20181009165936.3299723-1-ast@kernel.org>
On Tue, Oct 09, 2018 at 09:59:36AM -0700, Alexei Starovoitov wrote:
> BUG: KASAN: slab-out-of-bounds in _decode_session6+0x1331/0x14e0
> net/ipv6/xfrm6_policy.c:161
> Read of size 1 at addr ffff8801d882eec7 by task syz-executor1/6667
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
> print_address_description+0x6c/0x20b mm/kasan/report.c:256
> kasan_report_error mm/kasan/report.c:354 [inline]
> kasan_report.cold.7+0x242/0x30d mm/kasan/report.c:412
> __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
> _decode_session6+0x1331/0x14e0 net/ipv6/xfrm6_policy.c:161
> __xfrm_decode_session+0x71/0x140 net/xfrm/xfrm_policy.c:2299
> xfrm_decode_session include/net/xfrm.h:1232 [inline]
> vti6_tnl_xmit+0x3c3/0x1bc1 net/ipv6/ip6_vti.c:542
> __netdev_start_xmit include/linux/netdevice.h:4313 [inline]
> netdev_start_xmit include/linux/netdevice.h:4322 [inline]
> xmit_one net/core/dev.c:3217 [inline]
> dev_hard_start_xmit+0x272/0xc10 net/core/dev.c:3233
> __dev_queue_xmit+0x2ab2/0x3870 net/core/dev.c:3803
> dev_queue_xmit+0x17/0x20 net/core/dev.c:3836
>
> Reported-by: syzbot+acffccec848dc13fe459@syzkaller.appspotmail.com
> Reported-by: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This looks good, applied to the ipsec tree.
Thanks Alexei!
prev parent reply other threads:[~2018-10-12 17:41 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-09 16:59 [PATCH net] net/xfrm: fix out-of-bounds packet access Alexei Starovoitov
2018-10-12 10:09 ` Steffen Klassert [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181012100947.GD30955@gauss3.secunet.de \
--to=steffen.klassert@secunet.com \
--cc=ast@kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kernel-team@fb.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).