Re: KASAN: slab-out-of-bounds Read in tun_net_xmit (2)

On 2018/12/31 下午5:51, Jesper Dangaard Brouer wrote: Hi MST and Jason, Could you please take a look at this? This bug is caused by a thread resizing the tun-queue (via tun_queue_resize -> ptr_ring_resize_multiple). And error happens in tun_net_xmit -> ptr_ring_produce. My guess is bug happens

Re: KASAN: slab-out-of-bounds Read in tun_net_xmit (2)

Hi MST and Jason, Could you please take a look at this? This bug is caused by a thread resizing the tun-queue (via tun_queue_resize -> ptr_ring_resize_multiple). And error happens in tun_net_xmit -> ptr_ring_produce. My guess is bug happens when reading r->queue in ptr_ring_produce. I've look a

Re: KASAN: slab-out-of-bounds Read in tun_net_xmit (2)

syzbot has found a reproducer for the following crash on: HEAD commit:b71acb0e3721 Merge branch 'linus' of git://git.kernel.org/.. git tree: net-next console output: https://syzkaller.appspot.com/x/log.txt?x=1449435340 kernel config: https://syzkaller.appspot.com/x/.config?x=4b137b