On Fri, Aug 9, 2019 at 1:53 AM Dmitry Vyukov <dvyu...@google.com> wrote: > > On Fri, Aug 9, 2019 at 12:08 AM Tetsuo Handa > <penguin-ker...@i-love.sakura.ne.jp> wrote: > > > > On 2019/08/09 1:45, syzbot wrote: > > > Hello, > > > > > > syzbot found the following crash on: > > > > > > HEAD commit: 107e47cc vrf: make sure skb->data contains ip header to > > > ma.. > > > git tree: net > > > console output: https://syzkaller.appspot.com/x/log.txt?x=139506d8600000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=4dba67bf8b8c9ad7 > > > dashboard link: > > > https://syzkaller.appspot.com/bug?extid=b91501546ab4037f685f > > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > > This is not TOMOYO's bug. LSM modules expect that "struct sock" does not go > > away. > > > > Also, another use-after-free (presumably on the same "struct sock") was > > concurrently > > inflight at nr_insert_socket() in net/netrom/af_netrom.c . Thus, suspecting > > netrom's bug. > > There is a number of UAFs/refcount bugs in nr sockets lately. Most > likely it's the same issue them. Most of them were bisected to: > > commit c8c8218ec5af5d2598381883acbefbf604e56b5e > Date: Thu Jun 27 21:30:58 2019 +0000 > netrom: fix a memory leak in nr_rx_frame()
The UAF introduced by this commit has been fixed. There is another UAF in netrom which exists long before the above commit, it is not fixed. The last time I looked at it, it seems related to the state machine used by netrom sockets, so it is not easy. Thanks,
