Re: KASAN: use-after-free Read in _decode_session6

[Willem de Bruijn]

On Thu, Nov 7, 2019 at 8:42 AM syzbot
<syzbot+e8c1d30881266e47eb33@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>
> syzbot suspects this bug was fixed by commit:
>
> commit e7c87bd6cc4ec7b0ac1ed0a88a58f8206c577488
> Author: Willem de Bruijn <willemb@xxxxxxxxxx>
> Date:   Wed Jan 16 01:19:22 2019 +0000
>
>      bpf: in __bpf_redirect_no_mac pull mac only if present
>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1736f974600000
> start commit:   b36fdc68 Merge tag 'gpio-v4.19-2' of git://git.kernel.org/..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=4c7e83258d6e0156
> dashboard link: https://syzkaller.appspot.com/bug?extid=e8c1d30881266e47eb33
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14d42021400000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13d09f1e400000
>
> If the result looks correct, please mark the bug fixed by replying with:
>
> #syz fix: bpf: in __bpf_redirect_no_mac pull mac only if present

#syz fix: bpf: in __bpf_redirect_no_mac pull mac only if present

indeed manually reproduced at e7c87bd6cc4e~1, failed to reproduce at
e7c87bd6cc4e. Also seems plausible given the stack trace.