Re: KASAN: use-after-free Read in __cfg8NUM_wpan_dev_from_attrs

[Jiri Pirko]

Mon, Oct 07, 2019 at 04:19:09PM CEST, syzbot+9cb7edb2906ea1e83006@xxxxxxxxxxxxxxxxxxxxxxxxx wrote:
>Hello,
>
>syzbot found the following crash on:
>
>HEAD commit:    056ddc38 Merge branch 'stmmac-next'
>git tree:       net-next
>console output: https://syzkaller.appspot.com/x/log.txt?x=125aaafd600000
>kernel config:  https://syzkaller.appspot.com/x/.config?x=d9be300620399522
>dashboard link: https://syzkaller.appspot.com/bug?extid=9cb7edb2906ea1e83006
>compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
>syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1232bb3f600000
>C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=162d0d0b600000
>
>The bug was bisected to:
>
>commit 75cdbdd089003cd53560ff87b690ae911fa7df8e
>Author: Jiri Pirko <jiri@xxxxxxxxxxxx>
>Date:   Sat Oct 5 18:04:37 2019 +0000
>
>    net: ieee802154: have genetlink code to parse the attrs during dumpit
>
>bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=11be5d0b600000
>final crash:    https://syzkaller.appspot.com/x/report.txt?x=13be5d0b600000
>console output: https://syzkaller.appspot.com/x/log.txt?x=15be5d0b600000
>
>IMPORTANT: if you fix the bug, please add the following tag to the commit:
>Reported-by: syzbot+9cb7edb2906ea1e83006@xxxxxxxxxxxxxxxxxxxxxxxxx
>Fixes: 75cdbdd08900 ("net: ieee802154: have genetlink code to parse the attrs
>during dumpit")
>
>netlink: 'syz-executor134': attribute type 6 has an invalid length.
>==================================================================
>BUG: KASAN: use-after-free in nla_memcpy+0xa2/0xb0 lib/nlattr.c:572

I'm on this.