syzbot


KASAN: use-after-free Read in drm_getunique
Status: upstream: reported syz repro on 2021/06/02 07:48
Reported-by: syzbot+c3a706cec1ea99e1c693@syzkaller.appspotmail.com
Fix commit: b436acd1cf7f drm: Fix use-after-free read in drm_getunique()
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-arm32]
First crash: 152d, last: 148d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: KASAN: use-after-free Read in drm_getunique (log)
Repro: syz .config
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in drm_getunique syz done 2 154d 322d 1/1 fixed on 2021/06/26 05:18
linux-4.14 KASAN: use-after-free Read in drm_getunique syz 1 34d 316d 0/1 upstream: reported syz repro on 2020/12/15 15:58
Patch testing requests:
Created Duration User Patch Repo Result
2021/06/08 09:40 19m desmondcheongzx@gmail.com patch upstream OK

Sample crash report:

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-smack-root 2021/06/01 19:37 upstream c2131f7e73c9 032639db .config log report syz KASAN: use-after-free Read in drm_getunique
ci-upstream-kasan-gce-root 2021/05/29 07:42 upstream 5ff2756afde0 858ea628 .config log report syz KASAN: use-after-free Read in drm_getunique