On Thu, Apr 20, 2017 at 9:32 AM, Andrey Konovalov <andreyk...@google.com> wrote: > Hi, > > I've got the following error report while fuzzing the kernel with syzkaller. > > On linux-next commit 4f7d029b9bf009fbee76bb10c0c4351a1870d2f3 (4.11-rc7). > > A reproducer and .config are attached. > > ================================================================== > BUG: KASAN: stack-out-of-bounds in bond_enslave+0xe0a/0x4ef0 at addr > ffff8800666b7792 > Write of size 16 by task a.out/3894 > page:ffffea000199adc0 count:0 mapcount:0 mapping: (null) index:0x0 > flags: 0x100000000000000() > raw: 0100000000000000 0000000000000000 0000000000000000 00000000ffffffff > raw: 0000000000000000 ffffea000199ade0 0000000000000000 0000000000000000 > page dumped because: kasan: bad access detected > CPU: 1 PID: 3894 Comm: a.out Not tainted 4.11.0-rc7+ #251 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:16 > dump_stack+0x292/0x398 lib/dump_stack.c:52 > kasan_report_error mm/kasan/report.c:212 > kasan_report+0x4d8/0x510 mm/kasan/report.c:347 > check_memory_region_inline mm/kasan/kasan.c:326 > check_memory_region+0x139/0x190 mm/kasan/kasan.c:333 > memcpy+0x37/0x50 mm/kasan/kasan.c:369 > bond_enslave+0xe0a/0x4ef0 drivers/net/bonding/bond_main.c:1491 > bond_do_ioctl+0xb5d/0xec0 drivers/net/bonding/bond_main.c:3449 > dev_ifsioc+0x53f/0x9f0 net/core/dev_ioctl.c:338 > dev_ioctl+0x249/0x1160 net/core/dev_ioctl.c:532 > sock_do_ioctl+0x94/0xb0 net/socket.c:913 > sock_ioctl+0x28f/0x440 net/socket.c:1004 > vfs_ioctl fs/ioctl.c:45 > do_vfs_ioctl+0x1bf/0x1780 fs/ioctl.c:685 > SYSC_ioctl fs/ioctl.c:700 > SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
IPv6 tunnels use sizeof(struct in6_addr) as dev->addr_len but in many places we use struct sockaddr to set dev addr, whose ->sa_data only has 14 bytes...
