syzbot


pool: free list modified: aobjpl
Status: fixed on 2020/03/04 22:54
Reported-by: syzbot+0fc1766671a9461de8a5@syzkaller.appspotmail.com
Fix commit: c5a231fb6c1e Grab a reference for the shared memory segment before calling uvm_map() as the same function could end up putting the thread to sleep. Allowing another thread to free the shared memory segment, which in turns causes a use-after-free.
First crash: 609d, last: 597d
Patch testing requests:
Created Duration User Patch Repo Result
2020/02/22 15:45 19m anton@basename.se https://github.com/mptre/openbsd-src syzkaller OK

Sample crash report:

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-multicore 2019/12/05 23:36 openbsd ce2d25888d00 98b4ef2d .config log report syz C
ci-openbsd-main 2019/11/23 17:42 openbsd ee79b9a7c44b 598ca6c8 .config log report syz C
ci-openbsd-main 2019/11/23 16:06 openbsd ee79b9a7c44b 598ca6c8 .config log report