syzbot


KASAN: use-after-free Read in tipc_mcast_xmit (2)
Status: upstream: reported C repro on 2020/10/02 15:38
Reported-by: syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com
Fix commit: ed42989e tipc: fix the skb_unshare() in tipc_buf_append()
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386]
First crash: 24d, last: 10d

Cause bisection: introduced by (bisect log) :
commit ff48b6222e65ebdba5a403ef1deba6214e749193
Author: Xin Long <lucien.xin@gmail.com>
Date: Sun Sep 13 11:37:31 2020 +0000

  tipc: use skb_unshare() instead in tipc_buf_append()

Crash: WARNING: refcount bug in tipc_mcast_xmit (log)
Repro: C syz .config
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 KASAN: use-after-free Read in tipc_mcast_xmit C 23 6d07h 26d 0/1 upstream: reported C repro on 2020/09/29 18:19
upstream KASAN: use-after-free Read in tipc_mcast_xmit syz 7 672d 679d 12/17 fixed on 2019/01/11 01:22
linux-4.19 KASAN: use-after-free Read in tipc_mcast_xmit C 2 21d 21d 0/1 upstream: reported C repro on 2020/10/05 11:34
Patch testing requests:
Created Duration User Patch Repo Result
2020/10/08 03:08 17m xiyou.wangcong@gmail.com https://github.com/congwang/linux.git net OK

Sample crash report:

Crashes (37):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Maintainers
ci-upstream-bpf-kasan-gce 2020/10/01 23:13 bpf a59cf619 9602ddf4 .config log report syz C davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/16 07:01 bpf 28802e7c 6e262c73 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/16 03:15 bpf 28802e7c 6e262c73 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/16 01:56 bpf 28802e7c 6e262c73 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/15 09:45 bpf 28802e7c 63869021 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/14 20:01 bpf 28802e7c fc7735a2 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/12 10:36 bpf 28802e7c 4a77ae0b .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/12 08:38 bpf 28802e7c 4a77ae0b .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/10 22:36 bpf 28802e7c 4a77ae0b .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/10 00:51 bpf 28802e7c d81b165e .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/07 18:53 bpf d82a532a 1880b4a9 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/06 13:15 bpf d82a532a 1880b4a9 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/06 13:12 bpf d82a532a 1880b4a9 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/06 12:35 bpf d82a532a 1880b4a9 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/05 23:06 bpf d82a532a 1880b4a9 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/05 13:36 bpf d82a532a 5ef9c291 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/02 11:49 bpf a59cf619 9602ddf4 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/02 07:33 bpf a59cf619 9602ddf4 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/02 00:58 bpf a59cf619 9602ddf4 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-kasan-gce 2020/10/01 22:56 bpf a59cf619 9602ddf4 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/12 17:40 bpf-next 376dcfe3 d32b0bbf .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/10 14:30 bpf-next ac53a0d3 93817d89 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/10 11:13 bpf-next ac53a0d3 93817d89 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/09 04:18 bpf-next 1e9259ec 92390980 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/08 02:50 bpf-next bf88a80a 1880b4a9 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/07 11:35 bpf-next 67ed3755 1880b4a9 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/07 01:46 bpf-next dca4121c 1880b4a9 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/07 00:58 bpf-next dca4121c 1880b4a9 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-net-kasan-gce 2020/10/06 07:54 net-next c2568c8c 1880b4a9 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/05 15:15 bpf-next 1028ae40 5ef9c291 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/05 14:35 bpf-next 1028ae40 5ef9c291 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/03 19:05 bpf-next 1028ae40 2653fa43 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/03 18:31 bpf-next 1028ae40 2653fa43 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/03 13:50 bpf-next 1028ae40 2653fa43 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/02 20:01 bpf-next 360f8987 4969d6ca .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/02 10:43 bpf-next 6208689f 9602ddf4 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com
ci-upstream-bpf-next-kasan-gce 2020/10/02 02:15 bpf-next 6208689f 9602ddf4 .config log report info davem@davemloft.net, jmaloy@redhat.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, ying.xue@windriver.com