Re: [syzbot] [bpf?] [net?] KFENCE: memory corruption in pskb_expand_head

[Feng Tang]

On Sat, Oct 05, 2024 at 12:56:19AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    c02d24a5af66 Add linux-next specific files for 20241003
> git tree:       linux-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1404ab9f980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=94f9caf16c0af42d
> dashboard link: https://syzkaller.appspot.com/bug?extid=80b36e60457a005e0530
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10f633d0580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1204ab9f980000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/641e642c9432/disk-c02d24a5.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/98aaf20c29e0/vmlinux-c02d24a5.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/c23099f2d86b/bzImage-c02d24a5.xz
> 
> The issue was bisected to:
> 
> commit d0a38fad51cc70ab3dd3c59b54d8079ac19220b9
> Author: Feng Tang <feng.tang@xxxxxxxxx>
> Date:   Wed Sep 11 06:45:34 2024 +0000
> 
>     mm/slub: Improve redzone check and zeroing for krealloc()

Thanks for the report!

Marco Elver also reported similar issue [1]. We agreed to revert the patch
and work on a new version, and Vlastimil did zapped the patchset from his
'for-next' branch. I just rechecked and seems the pachset also sits on
another branch 'for-6.13/fixes' of slab tree.

Vlastimil, pls help to zap it from that branch also, thanks!

[1]. https://lore.kernel.org/all/CANpmjNM5XjwwSc8WrDE9=FGmSScftYrbsvC+db+82GaMPiQqvQ@xxxxxxxxxxxxxx/

- Feng