syzbot


pool: free list modified: shmpl
Status: fixed on 2019/10/29 17:45
Reported-by: syzbot+0de42c2e600a6dd3091d@syzkaller.appspotmail.com
Fix commit: d13730a27993 Copy in the user-supplied buffer in shmctl(2) before looking up the shared memory segment. Otherwise, if copyin ends up sleeping it allows another thread to remove the same segment leading to a use-after-free.
First crash: 877d, last: 782d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd pool: free list modified: shmpl (3) 1 418d 418d 0/3 auto-closed as invalid on 2020/09/01 15:24
openbsd pool: free list modified: shmpl (2) 1 598d 598d 0/3 auto-closed as invalid on 2020/03/04 23:09
Patch testing requests:
Created Duration User Patch Repo Result
2019/10/26 08:44 16m anton@basename.se https://github.com/mptre/openbsd-src shm OK

Sample crash report:

Crashes (22):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-main 2019/03/02 15:37 openbsd b4bf48081222 1c0e457a .config log report syz C
ci-openbsd-multicore 2019/06/05 05:20 openbsd 759317bf8c07 bfb4a51e .config log report
ci-openbsd-main 2019/06/04 10:41 openbsd 0bb0865d8b1d ce07a7ae .config log report
ci-openbsd-main 2019/05/16 15:31 openbsd f42f1754a5d1 f59a9cb5 .config log report
ci-openbsd-setuid 2019/05/06 00:59 openbsd b3b9c1b50a99 d28f4ce5 .config log report
ci-openbsd-main 2019/04/24 18:04 openbsd 40247284e05a 8e3c52b1 .config log report
ci-openbsd-main 2019/04/20 05:37 openbsd d2bd3ff2a67d b0e8efcb .config log report
ci-openbsd-setuid 2019/04/20 05:21 openbsd 288b7a5c2a7a b0e8efcb .config log report
ci-openbsd-setuid 2019/04/18 10:57 openbsd c2f34caa76c3 b0e8efcb .config log report
ci-openbsd-multicore 2019/04/10 16:59 openbsd 66f3c4a661b7 e955ac50 .config log report
ci-openbsd-setuid 2019/04/09 18:18 openbsd 996953b367ff 91d50a67 .config log report
ci-openbsd-setuid 2019/04/08 16:33 openbsd 255ddc57f342 0dfb0452 .config log report
ci-openbsd-setuid 2019/04/08 09:33 openbsd e4c7564ca5a8 c34fde03 .config log report
ci-openbsd-setuid 2019/04/07 17:44 openbsd 4253825dbbaa c34fde03 .config log report
ci-openbsd-setuid 2019/04/07 17:21 openbsd 4253825dbbaa c34fde03 .config log report
ci-openbsd-setuid 2019/03/28 05:32 openbsd c95a22197bfd f94f56fe .config log report
ci-openbsd-setuid 2019/03/28 04:05 openbsd c95a22197bfd f94f56fe .config log report
ci-openbsd-setuid 2019/03/28 03:09 openbsd c95a22197bfd f94f56fe .config log report
ci-openbsd-main 2019/03/15 04:07 openbsd fee69528d2cd d72db19b .config log report
ci-openbsd-main 2019/03/06 12:12 openbsd 2905afd1bbd6 05cf83bf .config log report
ci-openbsd-main 2019/03/04 07:14 openbsd 337a50c064c7 3419571c .config log report
ci-openbsd-main 2019/03/02 15:14 openbsd b4bf48081222 1c0e457a .config log report