syzbot


pool: free list modified: shmpl
Status: fixed on 2019/10/29 17:45
Reported-by: syzbot+0de42c2e600a6dd3091d@syzkaller.appspotmail.com
Fix commit: d13730a2 Copy in the user-supplied buffer in shmctl(2) before looking up the shared memory segment. Otherwise, if copyin ends up sleeping it allows another thread to remove the same segment leading to a use-after-free.
First crash: 328d, last: 234d
similar bugs (1):
Kernel Title Repro Bisected Count Last Reported Patched Status
openbsd pool: free list modified: shmpl (2) 1 50d 50d 0/3 upstream: reported on 2019/12/05 23:09

Sample crash report:

Crashes (22):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro
ci-openbsd-main 2019/03/02 15:37 openbsd b4bf4808 1c0e457a .config log report syz C
ci-openbsd-multicore 2019/06/05 05:20 openbsd 759317bf bfb4a51e .config log report
ci-openbsd-main 2019/06/04 10:41 openbsd 0bb0865d ce07a7ae .config log report
ci-openbsd-main 2019/05/16 15:31 openbsd f42f1754 f59a9cb5 .config log report
ci-openbsd-setuid 2019/05/06 00:59 openbsd b3b9c1b5 d28f4ce5 .config log report
ci-openbsd-main 2019/04/24 18:04 openbsd 40247284 8e3c52b1 .config log report
ci-openbsd-main 2019/04/20 05:37 openbsd d2bd3ff2 b0e8efcb .config log report
ci-openbsd-setuid 2019/04/20 05:21 openbsd 288b7a5c b0e8efcb .config log report
ci-openbsd-setuid 2019/04/18 10:57 openbsd c2f34caa b0e8efcb .config log report
ci-openbsd-multicore 2019/04/10 16:59 openbsd 66f3c4a6 e955ac50 .config log report
ci-openbsd-setuid 2019/04/09 18:18 openbsd 996953b3 91d50a67 .config log report
ci-openbsd-setuid 2019/04/08 16:33 openbsd 255ddc57 0dfb0452 .config log report
ci-openbsd-setuid 2019/04/08 09:33 openbsd e4c7564c c34fde03 .config log report
ci-openbsd-setuid 2019/04/07 17:44 openbsd 4253825d c34fde03 .config log report
ci-openbsd-setuid 2019/04/07 17:21 openbsd 4253825d c34fde03 .config log report
ci-openbsd-setuid 2019/03/28 05:32 openbsd c95a2219 f94f56fe .config log report
ci-openbsd-setuid 2019/03/28 04:05 openbsd c95a2219 f94f56fe .config log report
ci-openbsd-setuid 2019/03/28 03:09 openbsd c95a2219 f94f56fe .config log report
ci-openbsd-main 2019/03/15 04:07 openbsd fee69528 d72db19b .config log report
ci-openbsd-main 2019/03/06 12:12 openbsd 2905afd1 05cf83bf .config log report
ci-openbsd-main 2019/03/04 07:14 openbsd 337a50c0 3419571c .config log report
ci-openbsd-main 2019/03/02 15:14 openbsd b4bf4808 1c0e457a .config log report