syzbot


KASAN: use-after-free Write in validate_chain
Status: fixed on 2019/08/27 17:15
Reported-by: syzbot+55c548ad445cef6063ab@syzkaller.appspotmail.com
Fix commit: 95fa1454 bpf: sockmap/tls, close can race with map free
First crash: 94d, last: 83d
Bisection: introduced by (bisect log):

commit e9db4ef6bf4ca9894bb324c76e01b8f1a16b2650
Author: John Fastabend <john.fastabend@gmail.com>
Date: Sat Jun 30 13:17:47 2018 +0000

  bpf: sockhash fix omitted bucket lock in sock_close

Tree: upstream
Crash: KASAN: use-after-free Write in bpf_tcp_close (log)
Repro: syz .config

Sample crash report:

All crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro
ci-upstream-kasan-gce-smack-root 2019/06/21 00:29 upstream abf02e29 34bf9440 .config log report syz
ci-upstream-kasan-gce-smack-root 2019/07/01 22:29 upstream 6fbc7275 907bf746 .config log report syz
ci-upstream-kasan-gce-smack-root 2019/06/26 09:15 upstream 249155c2 0a8d1a96 .config log report syz