syzbot


KASAN: use-after-free Read in nbd_genl_connect
Status: upstream: reported C repro on 2021/02/22 08:25
Reported-by: syzbot+429d3f82d757c211bff3@syzkaller.appspotmail.com
Fix commit: c9a2f90f nbd: handle device refs for DESTROY_ON_DISCONNECT properly
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci2-upstream-kcsan-gce], missing on: [ci-qemu2-arm32 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-usb]
First crash: 8d19h, last: 20h13m

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: KASAN: use-after-free Read in nbd_put (log)
Repro: C syz .config
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in nbd_genl_connect C 1 7d08h 7d08h 0/1 upstream: reported C repro on 2021/02/21 14:36
linux-4.14 KASAN: use-after-free Read in nbd_genl_connect C 1 8d11h 8d11h 0/1 upstream: reported C repro on 2021/02/20 12:01
Patch testing requests:
Created Duration User Patch Repo Result
2021/02/22 18:17 18m josef@toxicpanda.com git://git.kernel.org/pub/scm/linux/kernel/git/josef/btrfs-next.git nbd-kasan-fix OK

Sample crash report:

Crashes (10):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2021/02/20 04:11 upstream f40ddce8 f689d40a .config log report syz C KASAN: use-after-free Read in nbd_genl_connect
ci-upstream-net-this-kasan-gce 2021/02/20 18:46 net 3af409ca 3e5ed8b4 .config log report syz C KASAN: use-after-free Read in nbd_genl_connect
ci-upstream-net-this-kasan-gce 2021/02/20 06:59 net 3af409ca f689d40a .config log report syz C KASAN: use-after-free Read in nbd_genl_connect
ci-upstream-net-kasan-gce 2021/02/21 16:12 net-next 38b5133a 3e5ed8b4 .config log report syz C KASAN: use-after-free Read in nbd_genl_connect
ci-upstream-net-kasan-gce 2021/02/20 22:36 net-next 38b5133a 3e5ed8b4 .config log report syz C KASAN: use-after-free Read in nbd_genl_connect
ci-upstream-net-kasan-gce 2021/02/20 17:15 net-next 38b5133a 3e5ed8b4 .config log report syz C KASAN: use-after-free Read in nbd_genl_connect
ci-upstream-net-kasan-gce 2021/02/20 13:12 net-next 38b5133a 3e5ed8b4 .config log report syz C KASAN: use-after-free Read in nbd_genl_connect
ci-upstream-kasan-gce-root 2021/02/28 03:02 upstream 5695e516 4c37c133 .config log report info KASAN: use-after-free Read in nbd_genl_connect
ci-upstream-kasan-gce-root 2021/02/20 03:19 upstream f40ddce8 f689d40a .config log report info KASAN: use-after-free Read in nbd_genl_connect
ci-upstream-net-this-kasan-gce 2021/02/21 05:59 net 3af409ca 3e5ed8b4 .config log report info KASAN: use-after-free Read in nbd_genl_connect