Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit

2017-04-25 Thread Andrey Konovalov
On Tue, Apr 25, 2017 at 7:04 AM, Cong Wang wrote: > On Mon, Apr 24, 2017 at 9:47 AM, Cong Wang wrote: >> >> We use ipv4 dst in ip6_tunnel and cast an IPv4 neigh key as an >> IPv6 address... >> >> >> neigh = dst_neigh_lookup(skb_dst(skb), >>

Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit

2017-04-24 Thread Cong Wang
On Mon, Apr 24, 2017 at 9:47 AM, Cong Wang wrote: > > We use ipv4 dst in ip6_tunnel and cast an IPv4 neigh key as an > IPv6 address... > > > neigh = dst_neigh_lookup(skb_dst(skb), > &ipv6_hdr(skb)->daddr); > if (!neigh) >

Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit

2017-04-24 Thread Cong Wang
On Mon, Apr 24, 2017 at 8:03 AM, Andrey Konovalov wrote: > Hi, > > I've got the following error report while fuzzing the kernel with syzkaller. > > On commit 5a7ad1146caa895ad718a534399e38bd2ba721b7 (4.11-rc8). > > Unfortunately it's not reproducible. > > The issue might be similar to this one: >

Re: net/ipv6: slab-out-of-bounds in ip6_tnl_xmit

2017-04-24 Thread Andrey Konovalov
On Mon, Apr 24, 2017 at 5:03 PM, Andrey Konovalov wrote: > Hi, > > I've got the following error report while fuzzing the kernel with syzkaller. > > On commit 5a7ad1146caa895ad718a534399e38bd2ba721b7 (4.11-rc8). > > Unfortunately it's not reproducible. > > The issue might be similar to this one: >

net/ipv6: slab-out-of-bounds in ip6_tnl_xmit

2017-04-24 Thread Andrey Konovalov
Hi, I've got the following error report while fuzzing the kernel with syzkaller. On commit 5a7ad1146caa895ad718a534399e38bd2ba721b7 (4.11-rc8). Unfortunately it's not reproducible. The issue might be similar to this one: https://groups.google.com/forum/#!topic/syzkaller/IDoQHFmrnRI ===