On Mon, Oct 13, 2025 at 4:08 PM Michael S. Tsirkin <[email protected]> wrote: > > On Mon, Oct 13, 2025 at 09:37:29AM +0200, Paolo Abeni wrote: > > On 10/13/25 9:20 AM, Jason Wang wrote: > > > On Mon, Oct 13, 2025 at 1:29 PM Jason Wang <[email protected]> wrote: > > >> On Sat, Oct 11, 2025 at 3:40 PM Jason Wang <[email protected]> wrote: > > >>> > > >>> #syz test > > >>> > > >>> On Sat, Oct 11, 2025 at 4:38 AM syzbot > > >>> <[email protected]> wrote: > > >> > > >> Paolo, it looks like the GSO tunnel features will leave uninitialized > > >> vnet header field which trigger KMSAN warning. > > >> > > >> Please have a look at the patch (which has been tested by syzbot) or > > >> propose another one. > > > > > > Forget the attachment. > > > > I have a few questions. The report mentions both UaF and uninit; the > > patch addresses "just" the uninit access. It's not clear to me if and > > how the UaF is addressed, and why/if it's related to the uninit access. > > > I'd like to understand that, too. > > > Do you know better?
Unfortunately, I didn't spot any UAF. > > > > It looks like the uninit root cause is on "the other side"? i.e. the > > device not initializing properly the header. The trace is in the TX path, so it's not the device side. > > Would unconditionally > > clearing the hash info implicitly disable such feature? The feature is not used on the TX side in virtio-net. On the RX side (e.g TUN) it has not been implemented yet. > > > > The syzbot dashboard mentions a (no more available) reproducer. Do you > > have it cached somewhere? I don't. Thanks > > > > Thanks, > > > > Paolo >
