Re: KASAN: slab-out-of-bounds Read in bpf_skb_vlan_push

[Dmitry Vyukov]

On Wed, Jun 13, 2018 at 8:15 PM, Daniel Borkmann <daniel@xxxxxxxxxxxxx> wrote:
> On 06/13/2018 08:13 PM, syzbot wrote:
>>> On 06/13/2018 06:17 PM, syzbot wrote:
>>>> Hello,
>>
>>>> syzbot found the following crash on:
>>
>>>> HEAD commit:    75d4e704fa8d netdev-FAQ: clarify DaveM's position for stab..
>>>> git tree:       bpf-next
>>>> console output: https://syzkaller.appspot.com/x/log.txt?x=1754783f800000
>>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=a601a80fec461d44
>>>> dashboard link: https://syzkaller.appspot.com/bug?extid=76de61614cb1abdd73fc
>>>> compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
>>>> syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=12c1e1bf800000
>>
>>>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>>>> Reported-by: syzbot+76de61614cb1abdd73fc@xxxxxxxxxxxxxxxxxxxxxxxxx
>>
>>>> IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
>>>> IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
>>>> 8021q: adding VLAN 0 to HW filter on device team0
>>>> 8021q: adding VLAN 0 to HW filter on device team0
>>>> ==================================================================
>>>> BUG: KASAN: slab-out-of-bounds in skb_at_tc_ingress include/net/sch_generic.h:535 [inline]
>>>> BUG: KASAN: slab-out-of-bounds in bpf_push_mac_rcsum net/core/filter.c:1625 [inline]
>>>> BUG: KASAN: slab-out-of-bounds in ____bpf_skb_vlan_push net/core/filter.c:2446 [inline]
>>>> BUG: KASAN: slab-out-of-bounds in bpf_skb_vlan_push+0x6b7/0x720 net/core/filter.c:2437
>>>> Read of size 5 at addr ffff8801b77347d0 by task syz-executor6/6529
>>
>>> Should be fixed already by:
>>
>>>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58990d1ff3f7896ee341030e9a7c2e4002570683
>>
>>
>>> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>>
>> want 2 args (repo, branch), got 1
>
> Fair enough ... assumed default would have been master. ;-)

There is an issue with making defaults. Some email clients reflow
emails and split lines and git repo address can be lengthy and trigger
such reflow. To work around this syzbot currently looks for 2 "tokens"
after syz test, not necessary on the same line. The default for branch
will cause ambiguity in parsing: is it only repo without branch, or is
it repo with branch on the next line? Engineering hits reality...

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master