On Fri, Aug 9, 2019 at 1:53 AM Dmitry Vyukov [off-list ref] wrote:

On Fri, Aug 9, 2019 at 12:08 AM Tetsuo Handa
[off-list ref] wrote:

quoted

On 2019/08/09 1:45, syzbot wrote:

quoted

Hello,

syzbot found the following crash on:

HEAD commit:    107e47cc vrf: make sure skb->data contains ip header to ma..
git tree:       net
console output: https://syzkaller.appspot.com/x/log.txt?x=139506d8600000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4dba67bf8b8c9ad7
dashboard link: https://syzkaller.appspot.com/bug?extid=b91501546ab4037f685f
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)

This is not TOMOYO's bug. LSM modules expect that "struct sock" does not go away.

Also, another use-after-free (presumably on the same "struct sock") was concurrently
inflight at nr_insert_socket() in net/netrom/af_netrom.c . Thus, suspecting netrom's bug.

There is a number of UAFs/refcount bugs in nr sockets lately. Most
likely it's the same issue them. Most of them were bisected to:

commit c8c8218ec5af5d2598381883acbefbf604e56b5e
Date: Thu Jun 27 21:30:58 2019 +0000
  netrom: fix a memory leak in nr_rx_frame()

The UAF introduced by this commit has been fixed. There is
another UAF in netrom which exists long before the above commit,
it is not fixed. The last time I looked at it, it seems related to the
state machine used by netrom sockets, so it is not easy.

Thanks,