syzbot


BUG: corrupted list in __nf_tables_abort
Status: fixed on 2020/03/17 22:09
Reported-by: syzbot+437bf61d165c87bd40fb@syzkaller.appspotmail.com
Fix commit: eb014de4fd41 netfilter: nf_tables: autoload modules from the abort path
First crash: 850d, last: 843d

Cause bisection: introduced by (bisect log) :
commit ec7470b834fe7b5d7eff11b6677f5d7fdf5e9a91
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon Jan 13 17:09:58 2020 +0000

  netfilter: nf_tables: store transaction list locally while requesting module

Crash: KASAN: use-after-free Read in __nf_tables_abort (log)
Repro: C syz .config

Fix bisection: fixed by (bisect log) :
commit 34682110abc50ffea7e002b0c2fd7ea9e0000ccc
Author: Max Chou <max.chou@realtek.com>
Date: Wed Nov 27 03:01:07 2019 +0000

  Bluetooth: btusb: Edit the logical value for Realtek Bluetooth reset


Sample crash report:

Crashes (29):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2020/01/25 16:15 upstream d5d359b0ac3f 2e95ab33 .config log report syz C
ci-upstream-kasan-gce 2020/01/25 12:33 upstream d5d359b0ac3f 2e95ab33 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/01/22 17:23 upstream d96d875ef5dd 8eda0b95 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/01/22 04:49 upstream d96d875ef5dd 8eda0b95 .config log report syz C
ci-upstream-kasan-gce-root 2020/01/21 22:35 upstream d96d875ef5dd 8eda0b95 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/01/21 17:32 upstream d96d875ef5dd 8eda0b95 .config log report syz C
ci-upstream-kasan-gce 2020/01/21 13:10 upstream d96d875ef5dd 8eda0b95 .config log report syz C
ci-upstream-kasan-gce-root 2020/01/21 11:24 upstream d96d875ef5dd 8eda0b95 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/01/21 09:14 upstream d96d875ef5dd 8eda0b95 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/01/21 02:31 upstream d96d875ef5dd d2557fb5 .config log report syz C
ci-upstream-kasan-gce-smack-root 2020/01/20 21:31 upstream def9d2780727 d2557fb5 .config log report syz C
ci-upstream-kasan-gce-root 2020/01/20 20:49 upstream def9d2780727 d2557fb5 .config log report syz C
ci-upstream-kasan-gce 2020/01/20 19:30 upstream def9d2780727 d2557fb5 .config log report syz C
ci-upstream-kasan-gce-386 2020/01/21 08:13 upstream d96d875ef5dd 8eda0b95 .config log report syz C
ci-upstream-kasan-gce-386 2020/01/20 17:05 upstream def9d2780727 d2557fb5 .config log report syz C
ci-upstream-net-this-kasan-gce 2020/01/25 15:32 net 61b1f2aff411 2e95ab33 .config log report syz C
ci-upstream-net-this-kasan-gce 2020/01/20 23:31 net 7008ee121089 d2557fb5 .config log report syz C
ci-upstream-net-this-kasan-gce 2020/01/20 06:09 net 09d4f10a5e78 0342f8c7 .config log report syz C
ci-upstream-net-this-kasan-gce 2020/01/20 00:25 net 09d4f10a5e78 0342f8c7 .config log report syz C
ci-upstream-net-this-kasan-gce 2020/01/19 21:08 net 09d4f10a5e78 0342f8c7 .config log report syz C
ci-upstream-net-this-kasan-gce 2020/01/19 19:56 net 09d4f10a5e78 0342f8c7 .config log report syz C
ci-upstream-net-this-kasan-gce 2020/01/19 12:27 net e02d9c4c68dc bc8bc756 .config log report syz C
ci-upstream-net-this-kasan-gce 2020/01/19 05:39 net e02d9c4c68dc bc8bc756 .config log report syz C
ci-upstream-net-this-kasan-gce 2020/01/19 00:07 net e02d9c4c68dc bc8bc756 .config log report syz C
ci-upstream-net-this-kasan-gce 2020/01/18 19:41 net e02d9c4c68dc 3de7aabb .config log report syz C
ci-upstream-net-this-kasan-gce 2020/01/18 08:20 net 5a9ef19454cd 3de7aabb .config log report syz C
ci-upstream-net-kasan-gce 2020/01/25 12:21 net-next 08a45c59f16e 2e95ab33 .config log report syz C
ci-upstream-net-kasan-gce 2020/01/21 01:21 net-next b3f7e3f23a76 d2557fb5 .config log report syz C
ci-upstream-kasan-gce 2020/01/22 19:46 upstream d96d875ef5dd 8eda0b95 .config log report