On Tue, Sep 05, 2023 at 04:02:19PM +0100, Robin Murphy wrote: > On 05/09/2023 3:37 pm, Will Deacon wrote: > > On Mon, Aug 28, 2023 at 03:04:44AM -0700, syzbot wrote: > > > HEAD commit: 908f31f2a05b Merge branch 'for-next/core', remote-tracking.. > > > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci > > > console output: https://syzkaller.appspot.com/x/log.txt?x=155e0463280000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=c1058fe68f4b7b2c > > > dashboard link: https://syzkaller.appspot.com/bug?extid=4a9f9820bd8d302e22f7 > > > compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 > > > userspace arch: arm64 > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bc548d280000 > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135bba3b280000 > > > > > > Downloadable assets: > > > disk image: https://storage.googleapis.com/syzbot-assets/87d095820229/disk-908f31f2.raw.xz > > > vmlinux: https://storage.googleapis.com/syzbot-assets/a1bf67af9675/vmlinux-908f31f2.xz > > > kernel image: https://storage.googleapis.com/syzbot-assets/7784a88b37e8/Image-908f31f2.gz.xz > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > Reported-by: syzbot+4a9f9820bd8d302e22f7@xxxxxxxxxxxxxxxxxxxxxxxxx > > > > > > netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 > > > netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 > > > ================================================================== > > > BUG: KASAN: slab-out-of-bounds in do_csum+0x44/0x254 arch/arm64/lib/csum.c:39 > > > Read of size 4294966928 at addr ffff0000d7ac0170 by task syz-executor412/5975 > > Yup, that looks suspiciously "-368"-shaped... > > > Judging by the UBSAN errors: > > > > | shift exponent 3008 is too large for 64-bit type 'u64' (aka 'unsigned long long') > > > > We're probably being passed a negative 'len' argument. It looks like the > > generic version in lib/checksum.c rejects that early, so maybe we should > > do the same in the arch code? > > Hmm, indeed I can offer no explanation as to why I put "if (len == 0)" there > rather than "if (len <= 0)" like literally every other C implementation* :/ I've made that change: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?h=for-next/fixes&id=8bd795fedb8450ecbef18eeadbd23ed8fc7630f5 Cheers, Will
