Re: [syzbot] [arm?] [netfilter?] KASAN: slab-out-of-bounds Read in do_csum

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


On 05/09/2023 3:37 pm, Will Deacon wrote:
[+Robin as he's had fun with the checksum code in the past]

On Mon, Aug 28, 2023 at 03:04:44AM -0700, syzbot wrote:

syzbot found the following issue on:

HEAD commit:    908f31f2a05b Merge branch 'for-next/core', remote-tracking..
git tree:       git:// for-kernelci
console output:
kernel config:
dashboard link:
compiler:       Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro:
C reproducer:

Downloadable assets:
disk image:
kernel image:

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4a9f9820bd8d302e22f7@xxxxxxxxxxxxxxxxxxxxxxxxx

netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
BUG: KASAN: slab-out-of-bounds in do_csum+0x44/0x254 arch/arm64/lib/csum.c:39
Read of size 4294966928 at addr ffff0000d7ac0170 by task syz-executor412/5975

Yup, that looks suspiciously "-368"-shaped...

Judging by the UBSAN errors:

| shift exponent 3008 is too large for 64-bit type 'u64' (aka 'unsigned long long')

We're probably being passed a negative 'len' argument. It looks like the
generic version in lib/checksum.c rejects that early, so maybe we should
do the same in the arch code?

Hmm, indeed I can offer no explanation as to why I put "if (len == 0)" there rather than "if (len <= 0)" like literally every other C implementation* :/


*apart from Loongarch who didn't exist at the time, but appear to have dutifully copy-pasted the same bug.

[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux