Re: net/ipv6: null-ptr-deref in ip6_route_del/lock_acquire

2017-02-27 Thread Andrey Konovalov
On Mon, Feb 27, 2017 at 9:34 PM, Cong Wang wrote: > On Mon, Feb 27, 2017 at 12:05 PM, Andrey Konovalov > wrote: >> On Mon, Feb 27, 2017 at 8:59 PM, David Ahern >> wrote: >>> On 2/27/17 10:11 AM, Cong Wang wrote: The attached patch fixes this crash, but I am not sure if it is the best

Re: net/ipv6: null-ptr-deref in ip6_route_del/lock_acquire

2017-02-27 Thread David Ahern
On 2/27/17 12:37 PM, Andrey Konovalov wrote: > That's what I thought when I read your message, thanks! > > I was just confused by David saying that the fuzzer is doing something > interesting, when the reproducer is just an ioctl call on a socket. It means I have a cold, recently off a plane and

Re: net/ipv6: null-ptr-deref in ip6_route_del/lock_acquire

2017-02-27 Thread Cong Wang
On Mon, Feb 27, 2017 at 12:05 PM, Andrey Konovalov wrote: > On Mon, Feb 27, 2017 at 8:59 PM, David Ahern wrote: >> On 2/27/17 10:11 AM, Cong Wang wrote: >>> The attached patch fixes this crash, but I am not sure if it is the >>> best way to fix this bug yet... >> >> I'll take a look. I can not re

Re: net/ipv6: null-ptr-deref in ip6_route_del/lock_acquire

2017-02-27 Thread David Ahern
On 2/27/17 10:11 AM, Cong Wang wrote: > The attached patch fixes this crash, but I am not sure if it is the > best way to fix this bug yet... I'll take a look. I can not reproduce this using route or ip, so the fuzzer is doing something interesting.

Re: net/ipv6: null-ptr-deref in ip6_route_del/lock_acquire

2017-02-27 Thread Andrey Konovalov
On Mon, Feb 27, 2017 at 8:59 PM, David Ahern wrote: > On 2/27/17 10:11 AM, Cong Wang wrote: >> The attached patch fixes this crash, but I am not sure if it is the >> best way to fix this bug yet... > > I'll take a look. I can not reproduce this using route or ip, so the > fuzzer is doing something

Re: net/ipv6: null-ptr-deref in ip6_route_del/lock_acquire

2017-02-27 Thread Cong Wang
On Mon, Feb 27, 2017 at 7:28 AM, Andrey Konovalov wrote: > Hi, > > I've got the following error report while fuzzing the kernel with syzkaller. > > On commit e5d56efc97f8240d0b5d66c03949382b6d7e5570 (Feb 26). > > A reproducer and .config are attached. > > kasan: CONFIG_KASAN_INLINE enabled > kasan