Re: [syzbot] KASAN: use-after-free Read in __crypto_xor

[Daniel Jordan]

On Thu, Sep 02, 2021 at 04:36:25PM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    3e12361b6d23 bcm63xx_enet: delete a redundant assignment
> git tree:       net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=160cec72300000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=63a23a80f42a8989
> dashboard link: https://syzkaller.appspot.com/bug?extid=b187b77c8474f9648fae
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=144d07b6300000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=171b7fca300000
> 
> The issue was bisected to:
> 
> commit 4611ce22468895acd61fee9ac1da810d60617d9a
> Author: Daniel Jordan <daniel.m.jordan@xxxxxxxxxx>
> Date:   Wed Jun 3 22:59:39 2020 +0000
> 
>     padata: allocate work structures for parallel jobs from a pool
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=118dccae300000
> console output: https://syzkaller.appspot.com/x/log.txt?x=158dccae300000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b187b77c8474f9648fae@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: 4611ce224688 ("padata: allocate work structures for parallel jobs from a pool")
> 
> ==================================================================
> BUG: KASAN: use-after-free in __crypto_xor+0x376/0x410 crypto/algapi.c:1001
> Read of size 8 at addr ffff88803691a000 by task kworker/u4:1/10

The reproducer hasn't tripped over this yet, but I'll keep trying.