Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone

From	David Ahern <dsa@cumulusnetworks.com>
Newsgroups	linux.kernel
Subject	Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone
Date	2017-04-19 01:30 +0200
Message-ID	<txKJk-3Uf-17@gated-at.bofh.it> (permalink)
References	(9 earlier) <tiIT8-6v2-23@gated-at.bofh.it> <tpCfT-87G-3@gated-at.bofh.it> <tpDlE-r8-11@gated-at.bofh.it> <tpDOF-Ur-9@gated-at.bofh.it> <txIet-2fd-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 4/18/17 2:43 PM, Andrey Konovalov wrote:
> I've finally managed to reproduce one of the crashes on commit
> 4f7d029b9bf009fbee76bb10c0c4351a1870d2f3 (4.11-rc7).
> 
> I'm not sure if this bug has the same root cause as the first one
> reported in this thread, but it definitely has to do with ipv6
> routing.
> 
> C reproducer, syzkaller program and my .config are attached.
> 
> Thanks!
> 
> kasan: CONFIG_KASAN_INLINE enabled
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] SMP KASAN
> Modules linked in:
> CPU: 1 PID: 4035 Comm: a.out Not tainted 4.11.0-rc7+ #250
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> task: ffff880069809600 task.stack: ffff880062dc8000
> RIP: 0010:ip6_rt_cache_alloc+0xa6/0x560 net/ipv6/route.c:975

From a quick glance seems to be a different bug than Dmitry's.

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: net: heap out-of-bounds in  fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone David Ahern <dsa@cumulusnetworks.com> - 2017-04-19 01:30 +0200
  Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone Andrey Konovalov <andreyknvl@google.com> - 2017-04-19 03:10 +0200

csiph-web