syzbot


KASAN: use-after-free Read in check_all_holdout_tasks_trace
Status: upstream: reported syz repro on 2021/05/21 17:29
Reported-by: syzbot+7b2b13f4943374609532@syzkaller.appspotmail.com
Fix commit: 1d10bf55d85d rcu-tasks: Don't delete holdouts within trc_inspect_reader()
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce], missing on: [ci-qemu2-arm32 ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-net-kasan-gce ci2-upstream-usb]
First crash: 67d, last: 5d14h

Cause bisection: introduced by (bisect log) :
commit f9006acc8dfe59e25aa75729728ac57a8d84fc32
Author: Florian Westphal <fw@strlen.de>
Date: Wed Apr 21 07:51:08 2021 +0000

  netfilter: arp_tables: pass table pointer via nf_hook_ops

Crash: WARNING in __nf_unregister_net_hook (log)
Repro: syz .config

Sample crash report:

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-bpf-next-kasan-gce 2021/06/18 20:44 bpf-next 0c38740c0896 aba2b2fb .config log report syz KASAN: use-after-free Read in check_all_holdout_tasks_trace
ci-upstream-bpf-kasan-gce 2021/07/18 02:28 bpf a6c39de76d70 f115ae98 .config log report info KASAN: use-after-free Read in check_all_holdout_tasks_trace
ci-upstream-bpf-next-kasan-gce 2021/05/17 16:41 bpf-next f18ba26da88a a2eb125d .config log report info KASAN: use-after-free Read in check_all_holdout_tasks_trace