syzbot

 sign-in | mailing list | source | docs
🐞 Open [987] ≡ Subsystems 🐞 Fixed [5238] 🐞 Invalid [12509] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

WARNING: refcount bug in cdev_get

Status: fixed on 2020/02/18 14:31
Reported-by: syzbot+82defefbbd8527e1c2cb@syzkaller.appspotmail.com
Fix commit: 68faa679b8be chardev: Avoid potential use-after-free in 'chrdev_open()'
First crash: 1714d, last: 1570d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: no output from test machine (log)
Repro: C syz .config
  
▶ ▼ Discussions (8)
Title Replies (including bot) Last reply
[PATCH 3.16 000/245] 3.16.83-rc1 review 260 (260) 2020/04/24 17:54
[PATCH 5.4 00/78] 5.4.12-stable review 107 (107) 2020/02/11 15:01
[PATCH 4.19 00/46] 4.19.96-stable review 51 (51) 2020/01/15 02:09
[PATCH 4.14 00/39] 4.14.165-stable review 44 (44) 2020/01/15 02:08
[PATCH 4.9 00/31] 4.9.210-stable review 36 (36) 2020/01/15 02:08
[PATCH 4.4 00/28] 4.4.210-stable review 33 (33) 2020/01/15 02:08
WARNING: refcount bug in cdev_get 7 (8) 2019/12/24 12:59
[PATCH] chardev: Avoid potential use-after-free in 'chrdev_open()' 3 (3) 2019/12/19 12:28
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 WARNING: refcount bug in cdev_get C done 12 1588d 1714d 1/1 fixed on 2020/01/19 15:05
linux-4.14 WARNING: refcount bug in cdev_get C done 21 1584d 1714d 1/1 fixed on 2020/01/24 06:24

Sample crash report:
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 11265 at lib/refcount.c:25 refcount_warn_saturate+0x174/0x1f0 lib/refcount.c:25
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 11265 Comm: syz-executor883 Not tainted 5.4.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 panic+0x2e3/0x75c kernel/panic.c:221
 __warn.cold+0x2f/0x3e kernel/panic.c:582
 report_bug+0x289/0x300 lib/bug.c:195
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 fixup_bug arch/x86/kernel/traps.c:169 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267
 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286
 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:refcount_warn_saturate+0x174/0x1f0 lib/refcount.c:25
Code: 06 31 ff 89 de e8 ec f9 e6 fd 84 db 0f 85 33 ff ff ff e8 9f f8 e6 fd 48 c7 c7 80 76 4f 88 c6 05 db 9a a4 06 01 e8 0b a3 b7 fd <0f> 0b e9 14 ff ff ff e8 80 f8 e6 fd 0f b6 1d c0 9a a4 06 31 ff 89
RSP: 0018:ffffc900045378a8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815e5a26 RDI: fffff520008a6f07
RBP: ffffc900045378b8 R08: ffff8880a365c600 R09: ffffed1015d645c9
R10: ffffed1015d645c8 R11: ffff8880aeb22e47 R12: 0000000000000002
R13: ffff88809fae8660 R14: ffff888092e3aa40 R15: ffff88809208b498
 refcount_add include/linux/refcount.h:191 [inline]
 refcount_inc include/linux/refcount.h:228 [inline]
 kref_get include/linux/kref.h:45 [inline]
 kobject_get+0x134/0x150 lib/kobject.c:644
 cdev_get+0x60/0xb0 fs/char_dev.c:355
 chrdev_open+0xb0/0x6b0 fs/char_dev.c:400
 do_dentry_open+0x4e6/0x1380 fs/open.c:797
 vfs_open+0xa0/0xd0 fs/open.c:914
 do_last fs/namei.c:3412 [inline]
 path_openat+0x10e4/0x4710 fs/namei.c:3529
 do_filp_open+0x1a1/0x280 fs/namei.c:3559
 do_sys_open+0x3fe/0x5d0 fs/open.c:1097
 __do_sys_open fs/open.c:1115 [inline]
 __se_sys_open fs/open.c:1110 [inline]
 __x64_sys_open+0x7e/0xc0 fs/open.c:1110
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x405ef1
Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 18 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007fa12008f8b0 EFLAGS: 00000293 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 6666666666666667 RCX: 0000000000405ef1
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fa12008f8d0
RBP: 00000000006dcc30 R08: 000000000000000f R09: 00007fa120090700
R10: 00007fa1200909d0 R11: 0000000000000293 R12: 00000000006dcc3c
R13: 00007ffea2bdbc9f R14: 00007fa1200909c0 R15: 0000000000000003
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (105):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/12/03 06:58 upstream 596cf45cbf6e ab342da3 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/12/03 06:28 upstream 596cf45cbf6e ab342da3 .config console log report syz C ci-upstream-kasan-gce-root
2019/12/02 13:19 upstream ceb307474506 f879db37 .config console log report syz C ci-upstream-kasan-gce
2019/11/30 13:06 upstream 81b6b96475ac 3a75be00 .config console log report syz C ci-upstream-kasan-gce-root
2019/09/22 02:11 upstream 227c3e9eb5cf d96e88f3 .config console log report syz C ci-upstream-kasan-gce
2019/09/15 06:33 upstream 1609d7604b84 32d59357 .config console log report syz C ci-upstream-kasan-gce-root
2019/09/14 04:23 upstream a7f89616b737 32d59357 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/08/16 21:50 upstream 2d63ba3e41db 8fd428a1 .config console log report syz C ci-upstream-kasan-gce-root
2019/08/16 21:12 upstream a69e90512d9d 8fd428a1 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/08/16 21:06 upstream 2d63ba3e41db 8fd428a1 .config console log report syz C ci-upstream-kasan-gce
2019/12/02 13:57 upstream ceb307474506 f879db37 .config console log report syz C ci-upstream-kasan-gce-386
2019/09/21 07:38 upstream f97c81dc6ca5 d96e88f3 .config console log report syz C ci-upstream-kasan-gce-386
2019/09/14 07:35 upstream a7f89616b737 32d59357 .config console log report syz C ci-upstream-kasan-gce-386
2019/08/16 22:25 upstream 2d63ba3e41db 8fd428a1 .config console log report syz C ci-upstream-kasan-gce-386
2019/12/16 02:50 linux-next 32b8acf85223 eef6e580 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/16 01:01 linux-next 32b8acf85223 eef6e580 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/14 12:35 linux-next 32b8acf85223 eef6e580 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/08/16 22:10 linux-next 0c3d3d648b3e 8fd428a1 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/03 07:17 upstream 596cf45cbf6e ab342da3 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/12/01 03:19 upstream 32ef9553635a a76bf83f .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/11/30 05:59 upstream 81b6b96475ac 3a75be00 .config console log report syz ci-upstream-kasan-gce
2019/09/25 06:41 upstream 351c8a09b00b e38a6630 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/09/24 19:58 upstream 4c07e2ddab5b 0942eab8 .config console log report syz ci-upstream-kasan-gce-root
2019/09/15 04:28 upstream 1609d7604b84 32d59357 .config console log report syz ci-upstream-kasan-gce
2019/12/02 12:16 upstream ceb307474506 f879db37 .config console log report syz ci-upstream-kasan-gce-386
2019/11/30 17:19 upstream 81b6b96475ac 3a75be00 .config console log report syz ci-upstream-kasan-gce-386
2019/09/28 18:04 linux-next bb2aee77c82d eb6b9855 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/12/17 09:53 upstream ea200dec5128 d13d7958 .config console log report ci-upstream-kasan-gce
2019/12/14 23:54 upstream e31736d9fae8 eef6e580 .config console log report ci-upstream-kasan-gce
2019/12/14 05:19 upstream 37d4e84f765b 5b2ca5da .config console log report ci-upstream-kasan-gce-selinux-root
2019/11/22 15:43 upstream 81429eb8d9ca 598ca6c8 .config console log report ci-upstream-kasan-gce-root
2019/11/19 21:47 upstream af42d3466bdc 5bc70212 .config console log report ci-upstream-kasan-gce-root
2019/11/18 22:51 upstream af42d3466bdc 1daed50a .config console log report ci-upstream-kasan-gce
2019/11/18 19:43 upstream af42d3466bdc 1daed50a .config console log report ci-upstream-kasan-gce-root
2019/11/17 14:44 upstream fe30021c36fb d5696d51 .config console log report ci-upstream-kasan-gce-selinux-root
2019/11/10 18:49 upstream 00aff6836241 dc438b91 .config console log report ci-upstream-kasan-gce-root
2019/11/10 08:07 upstream 00aff6836241 dc438b91 .config console log report ci-upstream-kasan-gce
2019/10/30 08:30 upstream 23fdb198ae81 5ea87a66 .config console log report ci-upstream-kasan-gce
2019/10/25 06:05 upstream 39a38bcba4ab d01bb02a .config console log report ci-upstream-kasan-gce-root
2019/10/24 00:16 upstream 13b86bc4cd64 b602d64b .config console log report ci-upstream-kasan-gce-root
2019/10/16 00:23 upstream 3b1f00aceb7a d4ea592f .config console log report ci-upstream-kasan-gce
2019/10/13 18:45 upstream da94001239cc 2f661ec4 .config console log report ci-upstream-kasan-gce-root
2019/10/10 19:12 upstream fb20da6af705 a4efa8c0 .config console log report ci-upstream-kasan-gce-root
2019/10/09 21:15 upstream e3280b54afed 312c6a5a .config console log report ci-upstream-kasan-gce-root
2019/10/09 10:25 upstream e3280b54afed 312c6a5a .config console log report ci-upstream-kasan-gce-root
2019/10/03 14:29 upstream 0f1a7b3fac05 fc17ba49 .config console log report ci-upstream-kasan-gce-selinux-root
2019/09/29 09:15 upstream 02dc96ef6c25 c1ad5441 .config console log report ci-upstream-kasan-gce-selinux-root
2019/09/24 18:46 upstream 4c07e2ddab5b 0942eab8 .config console log report ci-upstream-kasan-gce-root
2019/09/20 18:15 upstream 574cc4539762 d96e88f3 .config console log report ci-upstream-kasan-gce-selinux-root
2019/09/20 02:56 upstream 3c2edc36a774 4d3ae0b7 .config console log report ci-upstream-kasan-gce
2019/09/18 17:55 upstream 35f7a9526615 c2dcd700 .config console log report ci-upstream-kasan-gce-selinux-root
2019/09/17 11:13 upstream cef7298262e9 51ca0454 .config console log report ci-upstream-kasan-gce
2019/12/27 20:08 upstream f4b3974602a5 8b967267 .config console log report ci-qemu-upstream-386
2019/12/16 10:30 upstream 510c9788991c 0ae38e44 .config console log report ci-qemu-upstream-386
2019/11/24 17:02 upstream 6b8a79467876 598ca6c8 .config console log report ci-upstream-kasan-gce-386
2019/11/23 14:06 upstream 2027cabe6afe 598ca6c8 .config console log report ci-upstream-kasan-gce-386
2019/11/19 22:58 upstream af42d3466bdc 5bc70212 .config console log report ci-upstream-kasan-gce-386
2019/11/18 04:12 upstream cbb104f91dfe d5696d51 .config console log report ci-upstream-kasan-gce-386
2020/01/08 01:05 https://github.com/google/kasan.git usb-fuzzer ae1794106b94 6738e0b3 .config console log report ci2-upstream-usb
2019/12/31 08:13 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 7f117e28 .config console log report ci2-upstream-usb
2019/12/30 22:50 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 6b36d338 .config console log report ci2-upstream-usb
2019/12/26 23:08 https://github.com/google/kasan.git usb-fuzzer ecdf2214f472 be5c2c81 .config console log report ci2-upstream-usb
2019/12/13 05:33 https://github.com/google/kasan.git usb-fuzzer 4cc037ecf2cb 2a752b7c .config console log report ci2-upstream-usb
2019/12/07 21:15 linux-next 558c2bf52f61 1508f453 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/11/16 14:29 https://github.com/google/kasan.git usb-fuzzer 46178223c0ca cdac920b .config console log report ci2-upstream-usb
2019/11/08 16:50 linux-next 5591cf003452 1e35461e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/11/06 01:33 linux-next 51309b9d73f5 0f3ec414 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/11/02 20:38 https://github.com/google/kasan.git usb-fuzzer ff6409a6ec35 997ccc67 .config console log report ci2-upstream-usb
2019/10/21 15:48 https://github.com/google/kasan.git usb-fuzzer 22be26f76193 b24d2b8a .config console log report ci2-upstream-usb
2019/10/21 11:57 https://github.com/google/kasan.git usb-fuzzer 22be26f76193 8c88c9c1 .config console log report ci2-upstream-usb
2019/10/10 05:51 linux-next 4a9e93dbc796 c4b9981b .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/02 04:43 https://github.com/google/kasan.git usb-fuzzer 58d5f26a5584 b7a87a83 .config console log report ci2-upstream-usb
2019/09/23 10:22 linux-next b5b3bd898ba9 d96e88f3 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/20 22:53 https://github.com/google/kasan.git usb-fuzzer e0bd8d794fc9 d96e88f3 .config console log report ci2-upstream-usb
2019/09/20 15:22 linux-next eb2f12732f67 d96e88f3 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.