Re: KASAN: slab-out-of-bounds Read in erspan_xmit

[William Tu]

On Tue, Jan 23, 2018 at 11:45 AM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
> On Tue, Jan 23, 2018 at 8:17 PM, William Tu <u9012063@xxxxxxxxx> wrote:
>> Thanks for the reply.
>>
>> On Tue, Jan 23, 2018 at 11:03 AM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
>>> On Tue, Jan 23, 2018 at 7:58 PM, David Ahern <dsahern@xxxxxxxxx> wrote:
>>>> On 1/23/18 11:50 AM, William Tu wrote:
>>>>> Hi,
>>>>>
>>>>> I'm new to kasan and trying to follow this instruction to reproduce the issue:
>>>>> https://github.com/google/syzkaller/blob/master/docs/executing_syzkaller_programs.md
>>>>>
>>>>> After re-compile my kernel with KASAN related config enable, I run
>>>>> $ ./syz-execprog -cover=0 -repeat=0 -procs=16 program
>>>>>
>>>>> I wonder does the "program" mean the repro.c.txt? or I should compile
>>>>> it to binary?
>>>>> # gcc -o program repro.c.txt
>>>>> # ./syz-execprog myprogram
>>>>> 2018/01/23 10:45:19 parsed 0 programs
>>>>>
>>>>> And how to use the "repro.syz.txt"?
>>>>> It seems to have some command like "syz_emit_ethernet" to generate packet.
>>>>> but I have no clue where to run it. Maybe I'm still missing something?
>>>>>
>>>>
>>>> In the past I have only compiled a kernel with KASAN, compiled the
>>>> reproducer program and run it in a VM. No need for the syzbot overhead.
>>>
>>> Yes, if C program reproducer the crash then it's easier to use.
>>> repro.c.txt is the C program, you need to rename it to repro.c,
>>> compile with gcc and run just as ./a.out.
>>> But make sure that you have a gcc that supports KASAN (kernel build
>>> does not in the beginning on compiler not supporting KASAN). I think
>>> it's at least gcc 5+, but gcc 7+ would be better.
>>
>> I was using gcc 5+ and "gcc repro.c".
>> Running ./a.out does not show any issue on dmesg. Let me switch to gcc 7+.
>>
>>>
>>> You can also run the syzkaller reproducer as:
>>> ./syz-execprog -cover=0 -repeat=0 -procs=16 repro.syz.txt
>>
>> When using repro.syz.txt, which binary or what tests does it execute?
>
> It interprets the program in syzkaller notation in repro.syz.txt file.
> It should be more of less equivalent to repro.c.txt C program in
> behavior.
>
thanks!. Now I can reproduce the issue.