On Tue, Apr 23, 2019 at 2:51 PM Tycho Andersen <tycho@xxxxxxxx> wrote: > > On Tue, Apr 23, 2019 at 02:39:52PM -0700, Kees Cook wrote: > > On Mon, Mar 25, 2019 at 1:02 AM syzbot > > <syzbot+b562969adb2e04af3442@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote: > > > > > > Hello, > > > > > > syzbot found the following crash on: > > > > > > HEAD commit: 1bdd3dbf Merge tag 'io_uring-20190323' of git://git.kernel.. > > > git tree: upstream > > > console output: https://syzkaller.appspot.com/x/log.txt?x=12ae5b93200000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=9a31fb246de2a622 > > > dashboard link: https://syzkaller.appspot.com/bug?extid=b562969adb2e04af3442 > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=162ca25d200000 > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1733b53b200000 > > > > > > The bug was bisected to: > > > > > > commit a799aea0988ea0d1b1f263e996fdad2f6133c680 > > > Author: wenxu <wenxu@xxxxxxxxx> > > > Date: Wed Jan 9 02:40:11 2019 +0000 > > > > > > netfilter: nft_flow_offload: Fix reverse route lookup > > > > This bisection looks bogus? > > > > However, I _can_ trigger the problem on this kernel version with this > > config. (And not with Linus's latest tree.) > > > > The PoC is identical to the prior report[1] that we thought was fixed. > > Perhaps the fix didn't actually fix it? (I mean > > a811dc61559e0c8003f1086c2a4dc8e4d5ae4cb8) But it's been silent for 29 > > days now, so I'm not sure what's going on. > > > > Tycho are you able to reproduce this on the older tree? > > It looks like this case is using TSYNC and NEW_LISTENER together: > > syscall(__NR_seccomp, 1, 0xb, 0x20000140); Ah, thanks. My eye-diff didn't work. :) > and I did fix a uaf with TSYNC and NEW_LISTENER in this series: > > https://lore.kernel.org/lkml/20190306201413.14153-2-tycho@xxxxxxxx/T/#u > > which seems like it's probably related. I don't think the above ever > got applied though? Whoops, I lost this. Let me go dig that up. Thanks! -- Kees Cook
