Re: KASAN: slab-out-of-bounds Read in rt_cache_valid

[David Ahern]

On 6/3/19 11:10 PM, syzbot wrote:
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in rt_cache_valid+0x158/0x190
> net/ipv4/route.c:1556
> Read of size 2 at addr ffff8880654f3ac7 by task syz-executor.0/26603
> 
> CPU: 0 PID: 26603 Comm: syz-executor.0 Not tainted 5.2.0-rc2+ #9
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
> Â__dump_stack lib/dump_stack.c:77 [inline]
> Âdump_stack+0x172/0x1f0 lib/dump_stack.c:113
> Âprint_address_description.cold+0x7c/0x20d mm/kasan/report.c:188
> Â__kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
> Âkasan_report+0x12/0x20 mm/kasan/common.c:614
> Â__asan_report_load2_noabort+0x14/0x20 mm/kasan/generic_report.c:130
> Ârt_cache_valid+0x158/0x190 net/ipv4/route.c:1556
> Â__mkroute_output net/ipv4/route.c:2332 [inline]

This one appears to be a use after free. The fib entry is still live (in
the FIB) and the cached entry is still attached. Perhaps one too many
puts on the dst_entry.