syzbot


KASAN: use-after-free Read in ucma_close (2)
Status: upstream: reported syz repro on 2020/09/10 14:09
Reported-by: syzbot+cc6fc752b3819e082d0c@syzkaller.appspotmail.com
Fix commit: RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy
Patched on: [ci-upstream-linux-next-kasan-gce-root], missing on: [ci-qemu-upstream ci-qemu-upstream-386 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 18d, last: 18d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in sysfs_warn_dup (log)
Repro: syz .config
similar bugs (1):
Kernel Title Repro Bisected Count Last Reported Patched Status
upstream KASAN: use-after-free Read in ucma_close C 176 923d 936d 4/17 fixed on 2018/03/23 18:14
Patch testing requests:
Created Duration User Patch Repo Result
2020/09/11 18:19 16m jgg@ziepe.ca https://github.com/jgunthorpe/linux ucma_migrate_fix OK
2020/09/11 12:02 16m jgg@ziepe.ca git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git 308571debccd7004acf02ea1b7163a96ad772292 report log
2020/09/11 04:00 11m anant.thazhemadam@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log

Sample crash report:

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Maintainers
ci-upstream-kasan-gce-root 2020/09/10 11:25 upstream 34d4ddd3 409809d8 .config log report syz dledford@redhat.com, jgg@ziepe.ca, leon@kernel.org, linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org