From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753387AbdK2I5w (ORCPT ); Wed, 29 Nov 2017 03:57:52 -0500 Received: from mail-pl0-f52.google.com ([209.85.160.52]:42827 "EHLO mail-pl0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752534AbdK2I5v (ORCPT ); Wed, 29 Nov 2017 03:57:51 -0500 X-Google-Smtp-Source: AGs4zMa3n8W5bRdKNrB5CIio1N5n12FSvgJyZnsQJ0hjrpZLU9QtDfie9Ai3nQMVfp94yRV0/j/2xg== Date: Wed, 29 Nov 2017 00:57:47 -0800 From: Eric Biggers To: syzbot Cc: davem@davemloft.net, herbert@gondor.apana.org.au, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: KASAN: use-after-free Read in crypto_chacha20_crypt Message-ID: <20171129085747.GA20992@zzz.localdomain> References: <94eb2c111b8c32eea2055f0c983c@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <94eb2c111b8c32eea2055f0c983c@google.com> User-Agent: Mutt/1.9.1 (2017-09-22) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Nov 28, 2017 at 07:23:01AM -0800, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 1ea8d039f9edcfefb20d8ddfe136930f6e551529 > git://git.cmpxchg.org/linux-mmots.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > C reproducer is attached > syzkaller reproducer is attached. See https://goo.gl/kgGztJ > for information about syzkaller reproducers > > > ================================================================== > BUG: KASAN: use-after-free in __le32_to_cpup > include/uapi/linux/byteorder/little_endian.h:58 [inline] > BUG: KASAN: use-after-free in le32_to_cpuvp crypto/chacha20_generic.c:19 > [inline] > BUG: KASAN: use-after-free in crypto_chacha20_init > crypto/chacha20_generic.c:58 [inline] > BUG: KASAN: use-after-free in crypto_chacha20_crypt+0xaf1/0xbd0 > crypto/chacha20_generic.c:91 > Read of size 4 at addr ffff880100000006 by task syzkaller030711/3690 > #syz dup: general protection fault in crypto_chacha20_crypt